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^During  ihe  past  few  years,  several  private  companies  have  been  using  passenger  carrying  submersible*  to 
conduct  underwater  sightseeing  tours  for  tourists  For  submersible  operations  under  U  S  jurisdiction,  the 
Coast  Guard  is  required  by  law  to  establish  and  enforce  a  certain  minimum  level  of  safety  for  vessels  The 
existing  Coast  Guard  statutes  and  regulations  were  developed  primarily  for  surface  craft;  many  of  the 
requirements  cannot  be  applied  to  or  are  inappropriate  for  application  to  submersibles  Furthermore,  for 
passenger  carrying  submersibles,  the  complexity  and  new  concepts  employed  require  that  the  Coast  Guard 
develop  methods  to  adequately  evaluate  their  safety  This  report  presents  the  results  o'  the  system  safety 
analysis  conducted  to  identify  and  assess  the  hazards  associated  with  the  operation  of  passenger  carrying 
submersibles  Included  in  this  analysis  is  the  definition  of  the  submersible  system  in  terms  of  the  basic 
system  elements:  equipment  and  facilities,  procedures,  people,  and  the  environment  in  which  the 
submersible  system  operates  Hazard  identification  is  accomplished  through  the  creation  of  accident 
scenarios,  the  conduct  of  a  Preliminary  Hazard  Analysis,  and  the  development  of  Fault  Trees  Finally, 
undesired  events  resulting  from  the  hazards  are  assessed  for  event  severity  and  the  probability  of  event 
occurrence  General  countermeasures  to  mitigate  the  undesired  events  are  presented  and  the  factors  to 
be  considered  m  the  evaluation  of  the  countermeasures  are  delineated  j'  .  ,  ,  ^ 
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PREFACE 


During  the  past  few  years,  several  private  companies  have  been  using  passenger 
carrying  submersibles  to  conduct  underwater  sightseeing  tours  for  tourists.  For 
submersible  operations  under  U  S.  jurisdiction,  the  Coast  Guard  is  required  by  law  to 
establish  and  enforce  a  certain  minimum  level  of  safety  for  vessels.  The  existing 
Coast  Guard  statutes  and  regulations  were  developed  primarily  for  surface  craft; 
thus,  many  of  the  requirements  are  not  appropriate  for  application  to  submersibles. 
Furthermore,  the  complexity  and  new  concepts  employed  for  passenger  carrying 
submersibles  require  that  the  Coast  Guard  develop  methods  to  adequately  evaluate 
their  safety.  This  report  presents  the  results  of  the  system  safety  analysis  conducted 
to  identify  and  assess  the  hazards  associated  with  the  operation  of  passenger 
carrying  submersibles. 

This  study  was  conducted  under  the  direction  of  the  Ship  Design  Branch,  Safety  and 
Oversight  Section,  Marine  Technical  and  Hazardous  Materials  Division,  Office  of 
Marine  Safety,  Security  and  Environmental  Protection,  U  S.  Coast  Guard.  The 
authors  would  like  to  express  their  deep  appreciation  to  the  Coast  Guard  staff  for 
their  support  and  guidance  during  the  course  of  the  analysis.  The  authors  also  wish 
to  acknowledge  the  important  contributions  made  by  Albert  E.  Powell,  Dana  Stalcup 
and  Deborah  Lundberg  of  GP  Taurio,  Incorporated,  for  their  support  in  this  study 
and  the  preparation  of  the  Preliminary  Hazard  Analysis,  and  John  Witney  of  Sub 
Aquatics,  Inc.,  who  provided  assistance  in  understanding  the  operational  concerns 
of  the  submersible  operator.  John  Pritzlaff  and  R.  Frank  Busby  made  valuable 
contributions  by  providing  the  authors  with  an  understanding  of  the  how  and  why 
of  submersible  design  and  a  review  of  the  draft  final  report.  In  addition,  Captain 
Rod  Watterson  of  the  U  S.  Navy,  Barrie  Walden  of  '*'''0 ds  Hole  Oceanographic 
Institute,  and  Brian  Moriarty  shared  knowledge  and  'v  rience  which  provided 
insight  into  potential  hazards.  Finally,  the  authors  wish  to  express  their  appreciation 
to  James  H.  Kelley  for  his  assistance  in  editing  this  report. 
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1.  INTRODUCTION 


During  the  past  few  years,  several  private  companies  have  been  using  vessels  known 
as  submersibles  to  conduct  underwater  sightseeing  tours.  These  tours  provide 
passenger  with  the  opportunity  to  travel  beneath  the  ocean  without  knowing  how 
to  swim  or  wearing  diving  gear.  The  submersibles  have  viewports  which  provide 
passengers  with  panoramic  views  of  the  underwater  environment,  including  coral 
reefs,  tropical  fish,  shipwrecks,  etc.  Passenger  submersible  operations  in  the 
Caribbean  Sea  and  the  Pacific  Ocean  have  carried  many  thousands  of  tourists  during 
the  last  5  years 

The  U  S  Coast  Guard  is  required  by  law  to  enforce  a  certain  minimum  level  of  safety 
for  all  U  S  flag  vessels.  The  traditional  approach  has  been  to  establish  specific 
regulations  based  on  historical  experience  and  good  engineering  judgment.  When 
designs  are  submitted  which  are  beyond  the  scope  of  the  regulations,  the  design  is 
evaluated  based  on  an  equivalent  safety  level.  For  passenger  carrying  submersibles, 
the  complexity  and  new  concepts  employed  in  these  submersibles,  requires  that  the 
Coast  Guard  develop  methods  to  adequately  evaluate  their  safety.  Recognizing  the 
need  to  identify  and  prevent  the  occurrence  of  submersible  accidents,  system  safety 
analysis  is  a  method  which  can  be  employed  to  assist  the  Coast  Guard  in  evaluating 
these  new  concepts.  This  report  presents  the  results  of  the  system  safety  analysis  of 
passenger  carrying  submersible  operations  conducted  by  the  Transportation  Systems 
Center 

1.1  BACKGROUND  1 

For  many  years,  non-military  submersibles  have  been  used  to  assist  in  industrial, 
experimental  and  research  efforts;  these  submersibles  have  not  been  used  in  a 
service  for  which  the  existing  inspection  statutes  and  regulations  would  apply.  For 
this  new  generation  of  submersible  operations  under  U  S.  jurisdiction,  the  statutes 
and  regulations  applicable  to  small  passenger  vessels  are  currently  used  by  the  Coast 
Guard  to  evaluate  passenger  submersibles.  However,  since  these  regulations  were 
developed  primarily  for  surface  craft,  many  of  the  requirements  cannot  be  applied 
to  or  are  inappropriate  for  submersibles. 


The  regulations  that  are  currently  the  basis  for  passenger  submersible  certification 
are  found  in  46  CFR  Subchapter  T-Small  Passenger  Vessels  (less  than  100  tons).  The 
Coast  Guard  has  also  prepared  guideline  documents  T2  which  are  intended  to 
provide  basic  guidance  and  explain  the  current  systems  approach  for  submersible 
certification  and  stability. 

The  Coast  Guard  approach  to  the  novel  design  and  unique  operational  hazards  of 
submersibles  has  been  to  require  a  level  of  safety  that  is  equivalent  to  that  required 
for  a  surface  craft.  This  has  been  accomplished  through  a  combination  of  design 
requirements,  operational  restrictions,  and  the  requirement  for  redundant  systems. 
This  approach  is  intended  to  minimize  any  inherent  hazards  of  underwater 
operation. 

The  Coast  Guard  has  certified  submersible  operations  in  the  U  S.  Virgin  Islands, 
Hawaii,  and  Guam  by  using  a  systems  approach  to  evaluate  the  combined  design, 
operations,  dive  site,  and  operator  qualifications  from  the  conceptual  stage  through 
the  initial  operation.  After  initial  certification,  the  Coast  Guard  monitors  the 
operations  and  periodically  inspects  the  vessels  used.  Each  operation  has  been 
evaluated  individually  because  of  the  changing  nature  of  the  business  and  the  lack 
of  any  specific  regulations  pertaining  to  submersibles. 

1.2  PURPOSE  AND  SCOPE  OF  STUDY 

The  purpose  of  the  system  safety  analysis  presented  in  this  document  is  to  assist  the 
Coast  Guard  in  identifying  potential  safety  issues  associated  with  passenger  carrying 
submersible  operations.  For  the  purpose  of  this  study,  a  "submersible"  is  defined  as 
any  vessel  carrying  passengers  and  crew,  which  is  capable  of  operating  on  the 
surface,  submerging,  operating  submerged,  surfacing  and  remaining  afloat. 

As  stated  previously,  many  of  the  requirements  contained  in  the  existing  statutes 
and  regulations  cannot  be  applied  to  or  are  inappropriate  for  submersibles  because 
these  regulations  were  developed  primarily  for  surface  craft.  The  results  of  the 
analysis  contained  herein  are  intended  to  assist  the  Coast  Guard  in  examining  and 
modifying  (as  necessary)  existing  regulations  to  ensure  that  an  equivalent  level  of 
safety  is  maintained  in  underwater  operations. 
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!n  this  study,  the  submersible  system  is  defined  as  the  facilities  and  equipment,  the 
operating  personnel  and  passengers,  the  procedures  employed  in  operating  the 
system,  and  the  environment  in  which  these  elements  operate.  The  tourist 
submersible  is  defined  as  less  than  100  gross  tons,  expressly  designed  and  built  to 
carry  more  than  6  and  up  to  50  passengers  (plus  the  crew)  to  depths  of  150  to  250 
feet 

The  system  safety  concept  and  hazard  resolution  process  have  been  utilized  to 
perform  the  system  safety  analysis  contained  in  this  report.  The  overall  approach 
used  to  perform  the  system  safety  analysis  is  contained  in  Figure  1  -1 . 

Hazards  identified  and  recommended  corrective  actions  concern  the  equipment, 
environment,  procedures,  and  people  which  comprise  the  total  passenger 
submersible  system  The  hazards  identified  and  resolved  relate  primarily  to  the 
operation  of  the  submersible  while  it.  is  submerged  In  addition,  a  number  of 
hazards  pertaining  to  the  interface  between  the  submersible,  the  surface  support 
and  surface  taxi  vessels,  and  shore  facilities  have  been  considered. 
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FIGURE  1-1.  SYSTEM  SAFETY  ANALYSIS  OF  PASSENGER  CARRYING  SUBMERSIBLES 


2.  SYSTEM  SAFETY  APPROACH 

2.1  SYSTEM  SAFETY  CONCEPT 

System  Safety  is  the  application  of  special  technical  and  managerial  skills  to  the 
systematic,  forward-looking  identification  and  control  of  hazards  throughout  the 
life  cycle  of  a  project,  program,  or  activity. 3  The  concept  calls  for  safety  analyses  and 
hazard  control  actions,  beginning  with  the  conceptual  phase  of  a  system  and 
continuing  through  the  design,  production,  testing,  operation,  maintenance, 
periodic  inspection,  and  disposal  phases.  Applied  to  passenger  carrying 
submersibles,  this  focus  on  the  prevention  of  accidents  by  eliminating  and/or 
controlling  safety  hazards  in  a  systematic  manner  will  serve  to  reduce  the  identified 
system  hazards  to  the  lowest  practical  level  through  the  most  effective  use  of 
resources.  It  should  be  noted  that  system  safety  analysis  is  not  the  same  as  failure 
analysis.  This  distinction  is  important  because  a  hazard  involves  the  risk  of  loss  or 
harm  while  a  failure  does  not  always  result  in  loss  or  harm.  To  be  most  effective,  the 
System  Safety  approach  employs  a  hazard  resolution  process  from  the  Acquisition 
phase  through  the  Operations  phase  of  the  particular  system.  The  hazard  resolution 
process  depicted  in  Figure  2-1  presents  the  process  which  should  be  followed  to 
ensure  that  passengers  and  crew  are  provided  the  highest  degree  of  safety  practical. 

2.2  HAZARD  RESOLUTION  PROCESS 

2.2.1  System  Definition 

The  first  step  in  the  hazard  resolution  process  is  to  define  the  physical  and  functional 
characteristics  of  the  system  to  be  analyzed.  These  characteristics  are  presented  in 
terms  of  the  major  elements  which  make  up  the  system:  equipment,  procedures, 
people,  and  environment.  A  knowledge  and  understanding  of  how  the  individual 
system  elements  interface  with  each  other  is  essential  to  the  hazard  identification 
effort.  Section  3  of  +'  is  repc  t  describes  the  representative  passenger  carrying 
submersible  system  r-»  .  "ion. 

2.2.2  Hazard  Identificav  .. 

The  second  step  in  the  hazard  resolution  process  involves  the  identification  of 
hazards  and  the  determination  of  their  causes. 
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DEFINE  THE  SYSTEM 


•  DEFINE  THE  PHYSICAL  AND  FUNCTIONAL  CHARACTERISTICS  AND 
UNDERSTAND  AND  EVALUATE  THE  PEOPLE,  PROCEDURES,  FACILITIES  AND 
EQUIPMENT,  AND  THE  ENVIRONMENT 


IDENTIFY  HAZARDS 

•  IDENTIFY  HAZARDS  AND  UNDESIRED  EVENTS 

•  DETERMINE  THE  CAUSES  OF  HAZARDS 


ASSESS  HAZARDS 

•  DETERMINE  SEVERITY 

•  DETERMINE  PROBABILITY 

•  DECIDE  TO  ACCEPT  RISK  OR  ELIMINATE  /  CONTROL 


RESOLVE  HAZARDS 

•  ASSUME  RISK  OR 

•  IMPLEMENT  CORRECTIVE  ACTION 


-  ELIMINATE 

-  CONTROL 


FOLLOW-UP 

•  MONITOR  FOR  EFFECTIVENESS 

•  MONITOR  FOR  UNEXPECTED  HAZARDS 


FIGURE  2-1.  HAZARD  RESOLUTION  PROCESS 
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When  identifying  the  safety  hazards  present  in  a  system,  a  major  concern  is  that  only 
a  portion  of  the  total  number  of  system  hazards  has  been  identified.  The  type  and 
quality  of  the  hazard  analysis  will  influence  the  total  number  of  hazards  identified. 
There  are  four  basic  methods  of  hazard  identification  that  may  be  employed  to 
identify  hazards.  These  methods  are  : 

o  Data  from  previous  accidents  (case  studies)  or  operating  experience, 
o  Scenario  development  and  judgment  of  knowledgeable  individuals, 
o  Generic  hazard  checklists,  and 

o  Forma!  hazard  analysis  techniques. 

Section  4  describes  the  hazards  identified  for  the  representative  passenger  carrying 
submersible  system  using  these  methods. 

2.2.3  Hazard  Assessment 

The  third  step  in  the  hazard  resolution  process  is  to  assess  the  identified  hazards  in 
terms  of  the  severity  or  consequence  of  the  hazard  and  the  probability  of 
occurrence.  Figures  2-2  and  2-3  show  the  ranking  criteria  outlined  in  Military 
Standard:  System  Safety  Program  Requirements  (Mil-Std.  882B)4.  Figure  2-2  contains 
four  severity  categories  and  provides  a  general  description  of  the  characteristics 
which  define  the  "worst  case"  event.  Figure  2-3  lists  the  qualitative  ranking  of 
probability  categories  and  describes  the  characteristics  cf  each  level. 

The  Hazard  Risk  Index  (HRI),  presented  in  Figure  2-4,  is  a  value  derived  by 
considering  both  the  severity  and  probability  of  a  hazard.  The  HRI  presents  hazard 
analysis  data  in  a  format  (i.e.,  1  =  Unacceptable)  which  assists  the  decision  maker  in 
determining  whether  hazards  should  be  eliminated,  controlled,  or  accepted.  This 
provides  a  basis  for  logical  management  decision  making,  considering  both  the 
severity  and  probability  of  a  hazard.  It  should  be  noted  that  the  potential  severity  of 
a  hazard  cannot  be  reduced  unless  the  hazard  is  completely  eliminated  through  a 
major  redesign.  However,  the  probability  and  therefore  the  risk,  can  be  greatly 
reduced  by  incorporation  of  safety  devices,  warning  devices,  procedures  and 
training,  or  a  combination  involving  two  or  all  three. 

Section  4  futher  explains  how  the  passenger  carrying  submersible  system  hazards 
were  evaluated  in  terms  of  severity  and  probability. 
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CATEGORY 


SEVERITY 


CHARACTERISTICS 


1 

CATASTROPHIC 

DEATH  OR  SYSTEM 

LOSS 

It 

CRITICAL 

SEVERE  INJURY.  SEVERE  OCCUPATIONAL 

ILLNESS  OR  MAJOR  SYSTEM  DAMAGE 

III 

MARGINAL 

MINOR  INJURY.  MINOR  OCCUPATIONAL 

ILLNESS  OR  MINOR  SYSTEM  DAMAGE 

IV 

NEGLIGIBLE 

LESS  THAN  MINOR  INJURY. 

OCCUPATIONAL  ILLNESS  OR 

SYSTEM  OAMAGE 

REFERENCE  MIL  STO  882 B 


FIGURE  2-2,  HAZARD  SEVERITY  CATEGORIES 


DESCRIPTION* 

LEVEL 

SPECIFIC  INDIVIDUAL  ITEM 

FLEET  OR  INVENTORY" 

FREQUENT 

A 

LIKELY  TO  OCCUR  FREQUENTLY 

CONTINUOUSLY  EXPERIENCED 

PROBABLE 

B 

WILL  OCCUR  SEVERAL  TIMES  IN 

LIFE  OF  AN  ITEM 

WILL  OCCUR  FREQUENTLY 

OCCASIONAL 

C 

LIKELY  TO  OCCUR  SOMETIME  IN 

LIFE  OF  AN  ITEM 

WILL  OCCUR  SEVERAL  TIMES 

REMOTE 

D 

UNLIKELY  BUT  POSSIBLE  TO 

OCCUR  IN  LIFE  OF  AN  ITEM 

UNLIKELY  BUT  CAN  REASONABLY 

BE  EXPECTED  TO  OCCUR 

IMPROBABLE 

E 

SO  UNLIKELY,  IT  CAN  BE  ASSUMED 
OCCURRENCE  MAY  NOT  BE 
EXPERIENCED 

UNLIKELY  TO  OCCUR.  BUT 

POSSIBLE 

•  DEFINITIONS  OF  DESCRIPTIVE  WORDS  MAY  HAVE  TO  BE  MODIFIED  BASED  ON  QUANTITY  INVOLVED 
••  THE  SIZE  OF  THE  FLEET  OR  INVENTORY  SHOULD  BE  DEFINED 


REFERENCE  MIL  STO  8828 


FIGURE  2-3.  HAZARD  PROBABILITY  CATEGORIES 
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FREQUENCY  OF 
OCCURENCE 


HAZARD  CATEGORIES 


(A)  FREQUENT 


(  B  )  PROBABLE 


(C)  OCCASIONAL 


(  D)  REMOTE 


(  E  )  IMPROBABLE 


HAZARD  RISK  INDEX 


I  A,  I  B,  I  C,  IIA,  II  8,  III  A 
ID.  IIC.  II  D.  Ill  B.  me 
I  E,  II  E.  Ill  D,  III  E.  IVA.  iVB 
IVC,  IV  D,  IVE 


UNACCEPTABLE 

UNACCEPTABLE  (  MANAGEMENT  DECISION  REQUIRED  ) 
ACCEPTABLE  WITH  REVIEW  BY  MANAGEMENT 
ACCEPTABLE  WITHOUT  REVIEW 

ADAPTED  FROM  MIL  STD  882B 


FIGURE  2-4.  HAZARD  ASSESSMENT  MATRIX 

In  addition,  the  hazard  severity  and  probability  ranking  values  and  the  risk 
assessment  matrix  were  modified  to  assess  the  undesired  events  which  could  lead  to 
a  submersible  passenger/crew  casualty.  Section  5  describes  the  assessment  process 
used. 

2.2.4  Hazard  Resolution 

After  the  hazard  assessment  is  completed,  hazards  can  be  resolved  by  deciding  to 
either  assume  the  risk  associated  with  the  hazard  or  to  eliminate  or  control  the 
hazard.  Various  means  can  be  employed  in  reducing  the  risk  to  a  level  acceptable  to 
management.  Figure  2-5  presents  a  hazard  reduction  precedence  process  that  can 
be  used  to  determine  the  extent  and  nature  of  preventive  actions  that  can  be  taken 
to  reduce  the  risk  to  an  acceptable  level.  Resolution  strategies  or  countermeasures 
in  order  of  preference  are: 

Design  to  Eliminate  Hazards 

This  strategy  generally  applies  to  acquisition  of  new  equipment  or 
expansion  of  existing  systems;  however,  it  can  also  be  applied  to  any 
change  in  equipment  or  individual  subsystems.  However,  in  some  cases 
hazards  are  inherent  and  cannot  be  eliminated  completely  through 
design. 
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Source:  Roland  &  Moriarty,  System  Safety  Engineering  and  Management.  1983.3 

FIGURE  2-5.  HAZARD  REDUCTION  PRECEDENCE 
Design  for  Minimum  Hazards 

A  major  safety  goal  during  the  system  design  process  is  to  include 
safety  features  that  are  fail-safe  or  have  capabilities  to  handle 
contingencies  through  redundancies  of  critical  elements. 
Complex  features  that  could  increase  the  likelihood  of  hazard 
occurrence  should  be  avoided.  Damage  control,  containment, 
and  isolation  of  potential  hazards,  along  with  gradual  system 
performance  degradation,  should  be  specified  through  system 
safety  inputs.  The  safety  inputs  should  be  implemented  in 
addition  to  other  traditional  design  considerations. 

Safety  Devices 

Known  hazards  which  cannot  be  eliminated  or  minimized 
through  design  may  be  controlled  through  the  use  of 
appropriate  safety  devices.  This  could  result  in  the  hazards  being 
reduced  to  an  acceptable  risk  level.  Safety  devices  may  be  a  part 
of  the  system,  subsystem,  or  equipment. 


2-6 


Warning  Devices 

Where  it  is  not  possible  to  preclude  the  existence  or  occurrence 
of  an  identified  hazard,  visual  or  audible  warning  devices  may  be 
employed  for  the  timely  detection  of  conditions  that  precede 
the  actual  occurrence  of  the  hazard.  Warning  signals  and  their 
application  should  be  designed  to  minimize  the  likelihood  of 
false  alarms  that  could  lead  to  creation  of  secondary  hazardous 
conditions. 

Procedures  and  Training 

Where  it  is  not  possible  to  eliminate  or  control  a  hazard  using 
one  of  the  aforementioned  methods,  safe  procedures  and/or 
emergency  procedures  should  be  developed  and  formally 
implemented.  These  procedures  should  be  standardized  and 
used  in  all  test,  operational,  and  maintenance  activities. 
Personnel  should  receive  training  in  order  to  carry  out  these 
procedures. 

Hazard  Acceptance/Svstem  Disposal 

Where  it  is  not  possible  to  reduce  a  hazard  by  any  means,  a 
decision  must  be  made  to  either  accept  the  hazard  or  dispose  of 
the  system. 

For  this  report,  risk  reduction  countermeasures  were  developed  to  address 
passenger  carrying  submersible  undesired  events  identified  in  the  hazard  scenarios, 
hazard  checklists,  and  formal  analyses.  Section  6  contains  a  complete  discussion  of 
these  countermeasures.  Section  7  contains  a  review  of  an  assessment  of 
countermeasure  effectiveness  in  terms  of  effectiveness,  cost  of  implementation,  and 
enforcement. 

2.2.5  Follow-up 

The  last  step  in  the  hazard  resolution  process  is  follow-up.  It  is  necessary  to  monitor 
the  effectiveness  of  recommended  countermeasures  and  ensure  that  new  hazards 
are  not  introduced  as  a  result.  In  addition,  whenever  changes  are  made  to  any  of  the 
system  elements  (equipment,  procedures,  people,  and/or  environment),  a  hazard 
analysis  should  be  conducted  to  identify  and  resolve  any  new  hazards. 
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3.  SYSTEM  DEFINITION 


The  first  step  in  performing  a  hazard  analysis  is  to  define  the  system.  The  system 
definition  contained  in  this  section  briefly  describes  the  various  physical  and 
functional  characteristics  of  a  representative  passenger  carrying  submersible  system. 

3.1  GENERAL 

A  "submersible"  is  herein  defined  as  any  vessel  carrying  passengers  and  crew,  which 
is  capable  of  operating  on  the  surface,  submerging,  operating  submerged,  surfacing 
and  remaining  afloat.  The  submersible  operates  in  conjunction  with  a  surface 
support  vessel.  Existing  passenger  carrying  submersible  operations  vary  in  size, 
design,  construction,  operating  characteristics  (propulsion,  steering,  etc.)  and  depth 
and  location  of  the  dive  site. 

The  representative  submersible  described  herein  is  expressly  designed  and  built  to 
carry  more  than  6  and  up  to  50  passengers  (plus  the  crew)  to  depths  of  1 50  to  250 
feet.  Currently,  all  dive  sites  are  located  in  tropical  waters. 

For  the  purposes  of  this  hazard  analysis,  the  representative  tourist  submersible 
operation  will  utilize  a  submersible  (less  than  100  gross  tons  and  carrying  more  than 
6  passengers),  surface  support  and  passenger  ferry  vessels,  and  shore  facilities 
(mooring  and  maintenance).  Trained  company  personnel  who  operate  the  vessels 
and  conduct  the  underwater  tours  are  also  included  in  the  operation. 

Major  elements  which  make  up  the  system  are  briefly  reviewed  in  terms  of 
equipment/ facilities,  environment,  procedures,  and  people. 

3.2  EQUIPMENT/FACILITIES 

The  equipment  and  facilities  element  is  comprised  of  the  passenger  submersible, 
surface  vessels  (support  and  passenger  taxi),  and  shore  facilities  (for  docking, 
maintenance  and  rescue  recovery  equipment  /facilities). 

3.2.1  Passenger  Submersible 

The  passenger  submersible  provides  an  enclosed,  controlled  environment  for  tourists 
and  crew  to  occupy  while  traveling  to  different  depths  and  locations  beneath  the 
surface  of  the  sea.  The  representative  passenger  submersible  is  subject  to  the 
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requirements  of  the  Code  of  Federal  Regulations  (CFR)  Title  46  Shipping,  and  Title  33 
Ports  and  Waterways  Safety,  as  contained  in  Table  3-1.  Figure  3-1  indicates  the 
typical  location  of  several  passenger  submersible  systems.  The  representative 
passenger  submersible  consists  of  the  following  systems  and  subsystems: 

3.2.1 .1  Hull 

Pressure  hull  (main  structure). 

Exostructure  (exterior  attachments,  i.e.,  fairing,  ballast  tanks,  conning 
tower,  deck  railings  and  plates,  skids,  lifting  hooks,  etc.). 

Penetrations  (hatches,  viewports,  electrical,  mechanical,  etc.,  and  other 
equipment). 

Interior  arrangement  (separate  space  for  pilot,  passenger  seating, 
equipment,  and  storage). 

3. 2. 1.2  Ballast/Trim 

Ballast  Systems  ("hard"  -  variable,  "soft"  -  air,  fixed/jettison  weight, 
and  syntactic  buoyancy  foam,  and  other  insulation). 

Trim  (adjustment  of  the  longitudinal  inclination  of  the  vessel  by  either 
the  use  of  movable  trim  weight  or  the  variable  ballast  system). 

3.2.1 .3  Piloting 

Steering  gear,  rudder,  thrusters,  depth  gauge,  gyro,  and  compass. 
Exterior  running  lights. 

3.2.1 .4  Instrumentation,  Monitoring,  Alarms 

Gauges  and/or  indicators  to  monitor  submersible  depth,  heading, 
attitude,  condition  of  equipment,  interior  and  exterior  pressure, 
temperature,  humidity,  levels  of  oxygen  and  carbon  dioxide,  and  water 
level  within  ballast  tanks. 

Visual  or  audible  alarms  to  indicate  unsafe  conditions  or  equipment 
failures  and  detect  water  leaks  or  malfunctions. 

3. 2. 1.5  Electrical 

Power  supply  source  (high  and  low  capacity  batteries). 

Power  distribution  system. 

Electrical  cables,  wiring,  and  relay  panels. 

Circuit  breakers  and  power  cut-outs  to  shut  off  power  and  isolate 
equipment  as  necessary. 
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TABLE  3-1 .  EXISTING  CFR  REGULATIONS  APPLICABLE  FOR  SUBMERSIBLES 
(LESS  THAN  100  TONS,  CARRYING  MORE  THAN  6  PASSENGERS)* 


46  CFR  SHIPPING  (As  applicable) 


Subchapter  T  -  Small  Passenger  Vessels  (Under  100  Gross  Tons) 

Part  175  General  Provisions 

Part  176  Inspection  and  Certification 

Part  177  Construction  and  Arrangement 

Part  180  Lifesaving  Equipment 

Part  181  Fire  Protection  Equipment 

Part  182  Machinery  Installation 

Part  183  Electrical  Installation 

Part  184  Vessel  Control  and  Misc.  Systems  and  Equipment 
Part  185  Operations 


Subchapter  B  -  Merchant  Marine  Officers  and  Seamen 

Part  10  Licensing  of  Maritime  Personnel 
Part  12  Certification  of  Seamen 
Part  15  Manning  Requirements 

Subchapter  F  -  Marine  Engineering 

Part  50  General  Provisions 
Part  52  Power  Boilers 
Part  53  Heating  Boilers 

Part  54  Pressure  Vessels  (See  also  49  CFR  Transportation,  Subchapter  C 
-  Hazardous  Materials  Regulations) 

Part  55  Nuclear  Power  Plant  Components 
Part  56  Piping  Systems  and  Appurtenances 
Part  57  Welding  and  Brazing 

Part  58  Main  and  Auxiliary  Machinery  and  Related  Systems 
Part  59  Repairs  to  Boilers,  Pressure  Vessels  and  Appurtenances 
Part  61  Periodic  Tests  and  Inspections 

Part  63  Control  Systems  for  Automatic  Auxiliary  Heat  Equipment 
Part  64  Marine  Portable  Tanks 

Subchapter  3  -  Electrical  Engineering 
Part  110  General  Provisions 

Part  111  Electrical  Systems-General  Requirements 

Part  112  Emergency  Lighting  and  Power  Systems 

Part  113  Communications  and  Alarm  Systems  and  Equipment 

Subchapter  N  -  Dangerous  Cargoes 

Part  147  Regulations  Governing  Use  of  Dangerous  Articles  as  Ships  Stores 
and  Supplies  On  Board  Vessels 


*As  of  January  4,  1989 
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TABLE  3-1 .  EXISTING  CFR  REGULATIONS  APPLICABLE  FOR  SUBMERSIBLES 
(LESS  THAN  100  TONS,  CARRYING  MORE  THAN  6  PASSENGERS) 

(Continued) 


46  CFR  SHIPPING  (Continued) 


Subehapter  Q  -  Certain  Bulk  Dangerous  Cargoes 

Part  150  Compatibility  of  Cargoes 
Subpart  150.115  Definitions  (Hazardous  Materials) 

Subchapter  Q  -  Equipment,  Construction,  and  Materials:  Specifications  and  Approvals 

Part  160  Lifesaving  Equipment 
Part  161  Electrical  Equipment 
Part  162  Engineering  Equipment 
Part  163  Construction 
Part  164  Materials 

Subchapter  S  -  Subdivision  and  Stability 

Part  170  Stability  Requirements  for  all  Inspected  Vessels 
Part  171  Special  Rules  Pertaining  to  Passenger  Vessels 
Part  172  Special  Rules  Pertaining  to  Bulk  Cargoes 
Part  173  Special  Rules  Pertaining  to  Vessel  Use 
Part  174  Special  Rules  Pertaining  to  Specific  Vessel  Types 

Subchapter  V  -  Marine  Occupational  Safety  and  Health  Standards 

Part  197  General  Provisions 
Subpart  B  Commercial  Diving  Operations 


33  CFR  NAVIGATION  (As  Applicable) 


Subchapter  O  -  Pollution 

Part  155  Oil  Pollution  Prevention  Regulations  for  Vessels 
Part  159  Marine  Sanitation 

Subchapter  P  -  Ports  and  Waterways  Safety 
Part  160  General 

Part  161  Vessel  Traffic  .Management  (specifics  for  Puget  Sound,  etc.) 

Part  162  Inland  Waterways  Navigation  Requirements  (specifics  for  rivers,  etc.) 

Part  164  Navigation  Safety  Regulations  (for  1600  gross  tons  except  St  L.  Seaway) 

Part  165  Regulated  Navigation  and  Limited  Access  Areas  (by  CG  district) 

Part  166  Shipping  Safety  Fairways  (fairways  and  anchorages,  Gulf  of  Mexico  and  Calif.) 
Part  167  Offshore  Traffic  Separation  Schemes  (for  U.S.  ports) 
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FIGURE  3-1.  REPRESENTATIVE  PASSENGER  CARRYING  SUBMERSIBLES 


3.2.1 .6 


Lighting 

Interior  lighting 


Main  passenger  area,  pilot  console  and  hatchways 

Selected  lighting  fixtures  connected  to  the  emergency  power 

supply 

Exterior 

Running  lights 
Flood  lights  for  viewing 

J.2.1.7  Propulsion 

Main  propulsion  thrusters  (propellers  and  motors  or  water  jets). 

Vertical  thrusters  to  assist  with  the  ballast  system  in  ascending  and 
descending. 

Horizontal  thrusters  mounted  longitudinally  to  move  the  vessel 
forward  or  astern,  and  assist  the  vessel  in  turning  or  moving  sideways. 

3. 2. 1.8  Hydraulics  ( if  used) 

Hydraulic  fluid,  pump(s),  valve(s)  and  hoses  to  operate  the  steering 
controls,  trim  weight,  and  ballast  systems. 

3. 2. 1.9  Life  Support 

Oxygen  supply  system  (high  pressure  storage  tank  (cylinders)  necessary 
to  maintain  an  oxygen  level  of  approximately  21  %. 

Carbon  dioxide  (CO2)  removal  (scrubber)  system. 

Suction  fan/motor  to  draw  or  blow  air 

Cannisters  containing  a  chemical  powder  which  chemically 
absorbs  the  CO2  to  maintain  a  level  at  or  below  0.5%  by  volume. 

Atmospheric  control  system  to  remove  contaminates,  particulates,  and 
odors;  also  controls  humidity  and  temperature. 

3.2.  i. 10  Communications 

"Ship  to  ship"  -  Multichannel  VHF  marine  band  radio  communications. 

"Ship  to  sub"  -  Underwater  telephone  (UWT)  which  operates  on  dual 
frequencies  and  allows  through-water  acoustic  communications  with 
support  vessels  while  the  submersible  is  submerged. 
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Transducers  for  the  UWT  telephone  mounted  on  the  top  as  well  as  on 
the  bottom  of  the  submersible  to  permit  communications  when  the 
submersible  Is  submerged,  on  or  near  the  surface 

Intercom  system  (for  internal  communication  between  submersible 
crewmembers  and  from  the  crew  to  the  passengers). 

3.2.1.11  Lavatories  (If  provided) 

Toilet  and  a  sink. 

No  drinking  water  (exception:  emergency  supply). 

J. 2. 1.12  Emergency  Equipment 

A  Halon  1211  fire  extinguisher  for  use  when  no  passengers  are  on 
board  and  the  hatch  is  open.  A  Halon  1301  fire  extinguisher  for  use 
when  passengers  are  present  and  the  hatch  is  closed. 

First  aid  kit. 

Halon  1301  fire  extinguishing  system  (with  a  concentration  of  no 
greater  than  5%  by  volume). 

Inflatable  life  jackets  for  each  passenger  and  crewmember. 

Food  and  water  supplies  for  each  passenger  and  crew  in  sufficient 
quantities  to  sustain  life  for  72  hours. 

Reserve  72-hour  supply  of  oxygen  and  72-hour  supply  of  CO2  absorbent 
chemical  for  the  CO2  scrubber  system. 

Individual  breathing  units  (to  filter  out  smoke  from  a  fire)  for  each 
passenger  and  crew  with  the  exception  of  the  pilot.  The  pilot  is 
provided  with  a  separate  air  system  and  breathing  mask. 

A  separate  reserve  emergency  oower  supply  source  for  backup  power 
emergency  lights,  operation  of  the  reserve  oxygen  and  CO2  scrubber 
systems,  communications,  etc.,  capable  of  functioning  for  72  hours. 

Bilge  pump  to  pump  out  accumulated  w'ater  (condensation,  leaks  etc.) 
when  submersible  is  on  the  surface. 

Emergency  manual  controls,  including  switches  and  overrides  to  isolate 
or  transfer  power,  etc. 

Exterior  manual  controls  for  hatch  operation,  blowing  of  the  air  ballast 
tanks,  and  the  release  of  jettison  drop  weights  from  the  outside  of  the 
submersible. 


3-7 


Locating  devices 

Emergency  buoy  or  a  dye  marker  (manual  release ) 

Acoustic  beacon  (pinger  mode  of  UWT)  connected  to  the 
emergency  power  supply  to  provide  submersible  location  at 
depths  of  more  than  200  feet. 


3.2.2  Surface  Support  Vessel 

The  surface  support  vessel  remains  at  the  dive  site  at  all  times  while  the  submersible 
is  in  the  area.  The  support  vessel  maintains  constant  communication  with  the 
submersible  and  carries  special  equipment  to  be  used  during  emergencies  or  for 
rescue  or  recovery.  The  support  vessel  is  not  required  to  be  inspected  or  certified. 
However,  it  is  subject  to  regulations  contained  in  46  CFR,  Subchapter  C  Uninspected 
Vessels. 

3. 2. 2.1  Communications 

In  addition  to  the  capability  of  communicating  with  the  passenger  taxi  vessel,  other 
surface  vessels,  and  the  shore,  the  surface  support  vessel  has  the  capability  of  directly 
communicating  with  the  submersible  in  three  ways: 

VHF  radio  while  the  submersible  is  on  the  surface, 

Underwater  telephone  when  the  submersible  is  underwater,  and 

Special  marker  boards  and  markers  which  can  used  by  divers  to  write 
messages  to  the  submersible  crew. 


3. 2. 2. 2  Special  Equipment 

Spotlights  which  can  be  directed  at  a  particular  location,  a  marking 
buoy  to  indicate  the  location  of  the  submersible  if  necessary,  rope, 
cables,  and  othertools. 

Self-contained  underwater  breathing  equipment  with  air  storage 
cylinders  which  can  be  used  by  scuba  divers.  These  divers  (depending 
on  operating  depth)  can  assist  the  submersible  in  surfacing  (by  using 
exterior  air  ballast  controls,  or  releasing  jettison  weight),  attaching 
markers  or  lift  lines/cables,  and  flotation  devices. 
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3.2.3  Passenger  Taxi  (Ferry)  Vessel 

The  taxi  vessel  transports  passengers  from  the  shore  facility  to  the  dive  site.  The 
current  Coast  Guard  requirement  for  the  capacity  of  this  vessel  is  twice  the  maximum 
number  of  passengers  and  crew  which  could  be  carried  aboard  the  submersible. 

3.2. 3.1  General 

If  the  vessel  is  more  than  100  gross  tons,  construction  and  arrangement  should  be 
according  to  46  CFR  Subchapter  H,  Part  72;  Lifesaving  equipment  should  be 
according  to  Part  75;  Fire  protection  equipment  to  Part  76;  Vessel  control  and 
miscellaneous  systems  and  equipment  to  Part  77;  and  Operations  to  Part  78.  Also 
applicable  are  parts  of  46  CFR  Subchapter  F,  Marine  Engineering;  Subchapter  J, 
Electrical  Engineering;  Subchapter  Q,  Equipment,  Construction  and  Materials: 
Specifications  and  Approvals;  Subchapter  S,  Subdivision  and  Stability;  and  finally,  33 
CFR  Subchapter  O,  Part  1 55  Oil  Pollution  Prevention,  and  Part  1 59  Sanitation. 

If  the  vessel  is  less  than  100  gross  tons,  the  vessel  is  subject  to  all  CFR  regulations  cited 
above  with  the  substitution  of  46  CFR  Subchapter  T  (for  46  CFR  Subchapter  H), 
including  Part  176,  Inspection  and  Certification;  Part  177,  Construction  and 
Arrangement;  Part  180,  Lifesaving  equipment;  Part  181,  Fire  Protection  Equipment; 
Part  182,  Machinery  Installation;  Part  183,  Electrical  Installation;  Part  184,  Vessel 
Control  and  Miscellaneous  Systems  and  Equipment,  Part  185  Operations;  and  Part 
186  Manning. 

3. 2. 3. 2  Communications 

In  addition  to  the  capability  of  communicating  with  the  surface  support  vessel,  other 
surface  vessels,  and  the  shore,  the  passenger  taxi  vessel  is  able  to  communicate  with 
the  submersible  through  VHF  radio  while  the  submersible  is  on  the  surface  and 
underwater  telephone  while  the  submersible  is  underwater. 

3.2.4  Shore  Facilities 

Shore  facilities  consist  of  a  dock  which  allows  an  orderly  loading  and  unloading  of 
passengers  from  the  passenger  taxi  vessel,  space  for  docking  of  all  vessels,  storage, 
and  maintenance. 
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Shore  facilities  also  maintain  rescue  capabilities,  either  company  owned  or  available 
upon  notification  (short  notice)  from  other  sources.  Communications  equipment 
capable  of  contacting  organizations  with  rescue  capabilities  is  maintained. 
Emergency  equipment  may  include  cranes,  a  remotely  operated  vehicle  (ROV),  or 
attachable  buoyancy/flotation  devices  capable  of  lifting  the  submersible  from  the 
sea  bed  (depending  on  the  depth  of  operations). 

3.3  ENVIRONMENT 

This  element  of  the  submersible  operation  system  consists  of  the  environment  in 
which  the  submersible  operates  and  the  environment  provided  to  passengers.  The 
environment  has  been  categorized  as  follows:  operating,  physical,  and  passenger. 

3.3.1  Operating  Environment 

The  number  of  trips  (dives)  by  the  submersible,  distance  to  the  dive  site,  duration  of 
dive,  and  night-time  operation,  are  all  determined  by  company  policy.  Factors  which 
influence  these  operations  include  equipment  capability  and  capacity,  number  of 
crew  and  experience,  weather  conditions,  and  Coast  Guard  or  local  authority 
requirements. 

3.3.2  Physical  Environment 

The  location  and  route  which  the  submersible  follows  in  conducting  the  underwater 
tour  is  selected  to  offer  passengers  the  maximum  visual  experience.  Visibility, 
weather,  and  sea  state  are  also  considered  because  of  the  transfer  of  passengers  to 
and  from  the  submersible  while  located  away  from  docking  facilities. 

Tours  follow  consistent  paths  over  the  known  sea  bed  bottom.  The  dive  site  can  be 
located  at  a  distance  of  1  to  3  miles  from  shore.  Passenger  submersible  operations 
are  presently  conducted  in  tropical  waters. 

The  normal  operating  depth  while  underwater  varies  between  40  and  250  feet. 
Maximum  diving  depth  ranges  between  150  and  250  feet.  Water  depth  should  not 
exceed  the  rated  operating  depth  of  the  submersible. 


The  maximum  forward  speed  of  the  submersible  while  submerged  is  2  knots.  While 
the  tour  is  underway,  the  normal  cruising  speed  is  0.5  to  1 .0  knots. 


3.3.3  Passenger  Environment 


3.3.3.1  Submersible 

The  passenger  compartment  of  the  submersible  provides  an  environment  in  which 
passengers  can  travel  underwater  protected  from  direct  contact  with  marine  life  or 
hazards  and  without  the  need  for  special  individual  breathing  equipment.  An 
interior  atmospheric  pressure  is  maintained  equal  to  the  surface  (1  atmosphere). 
Temperature  and  humidity  are  maintained  at  a  comfortable  level;  the  oxygen  level 
is  maintained  at  approximately  21%. 

The  length  of  time  that  the  passengers  actually  spend  underwater  during  each  dive 
ranges  from  45  minutes  to  one  hour.  Large  viewports  which  allow  passengers  a 
panoramic  view  outside  are  located  along  both  sides  of  the  submersible.  The 
interior  height  of  the  passenger  cabin  varies  with  location  in  the  submersible  while 
the  interior  length  varies  according  to  passenger  capacity.  Submersible  capacity 
varies  between  6  and  50  passengers  (not  including  the  crew) . 

Separate  supplies  of  emergency  provisions  (food,  water,  oxygen,  CO2  absorbent) 
sufficient  to  maintain  life  for  72  hours  are  carried  onboard  the  submersible. 

3. 3. 3. 2  Passenger  Taxi  Vessel 

The  taxi  vessel  transports  passengers  from  the  shore  facilities  to  the  dive  site.  The 
passenger  capacity  of  the  taxi  vessel  is  twice  the  capacity  of  the  submersible.  The 
length  of  time  to  reach  the  dive  site  by  the  taxi  vessel  from  shore  can  range  from  10 
to  40  minutes.  Passengers  may  transfer  to  the  submersible  by  means  of 
ramps/gangways  equipped  with  railings  or  may  simply  transfer  by  stepping  directly 
from  the  taxi  vessel  to  the  submersible. 

3.4  PROCEDURES 

This  element  of  the  system  consists  of  the  procedures  associated  with  the  operation 
of  the  submersible.  The  procedures  are  used  by  the  submersible  crew,  surface  vessel 
(support  and  taxi)  crews  and  shore  staff.  Categories  of  procedures  include  normal 
operating  procedures  (for  day  and  night  dives),  documentation  procedures, 
communication  procedures,  maintenance  procedures,  training  procedures,  and 
emergency  procedures. 


3.4.1  Normal  Operations 


3. 4.1.1  Standard  Operating  Procedures 

Standard  operating  procedures  (SOPs)  apply  to  the  entire  sequence  of  events  and 
procedures  which  occur  before,  during,  and  after  submersible  dives  during  day  or 
night  operations.  Operations  at  night  are  assumed  to  parallel  the  SOPs  used  during 
day  operations  with  the  addition  of  procedures  for  the  checking  and  use  of  lighting 
(dock,  exterior  lights  of  surface  vessels  and  submersible).  The  SOPs  comprise  the 
following  sequence  of  phases. 

Phase  1  -  includes  assignment  of  crew  duties  and  completion  of  procedures  to  check 
the  proper  operation  of  all  vessels  and  equipment  before  the  vessels  leave  the  shore 
for  any  particular  day.  In  addition,  the  weather,  sea  state,  and  other  conditions  are 
reviewed  and  the  dive  site  verified  (if  there  are  alternate  approved  locations). 

Phase  2  -  concerns  submersible  travel  to  the  dive  site. 

Phase  3  -  covers  passenger  travel  to  the  dive  site  and  transfer  to  the  submersible.  On 
shore,  the  taxi  vessel  is  loaded  with  passengers  and  transports  them  to  the  dive  site. 
Positioning  of  the  taxi  vessel  alongside  the  submersible  and  casting  on  of  lines  is 
completed  after  arrival  at  the  dive  site.  Hatches  are  then  opened,  previous 
passengers  (if  any)  are  off-loaded,  and  a  new  load  of  passengers  boarded. 

Phase  4  -  involves  the  actual  preparation  for  the  scheduled  dive.  Procedures  include 
closing  of  the  hatches,  casting  off  of  lines  and  performing  a  pre-dive  check  by  the 
submersible  crew  prior  to  descent.  In  addition,  the  location  and  operation  of 
emergency  equipment  (i.e  ,  oxygen  masks  and  life  preservers)  is  explained  to  the 
passengers. 

Phase  5  -  consists  of  the  submersible  crew  carrying  out  the  procedures  necessary  to 
descend.  After  the  submersible  reaches  the  desired  depth,  ballast  is  then  adjusted  so 
that  a  slight  positive  buoyancy  is  maintained  throughout  the  dive. 


Phase  6  -  After  descent  to  the  operating  depth  is  completed,  the  submersible  pilot 
maneuvers  along  the  selected  route  for  the  underwater  tour.  The  surface  support 
vessel  keeps  the  area  directly  above  the  submersible  clear  of  any  other  surface 


vessels  and  maintains  communications.  The  surface  taxi  vessel  returns  to  the  dock, 
off-loads  passengers,  boards  new  passengers,  and  returns  to  the  dive  site. 

Phase  7  -  Upon  the  completion  of  the  dive,  the  submersible  pilot  notifies  the  surface 
support  vessel  of  intention  to  end  the  dive  and  then  carries  out  ascent  procedures. 
Upon  reaching  the  surface,  the  procedures  for  loading  and  unloading  passengers  are 
repeated  with  the  addition  of  a  post-dive  check  by  the  submersible  crew  prior  to  the 
boarding  of  new  passengers.  Procedures  described  in  phases  3  throuqh  7  are 
repeated  for  each  subsequent  dive. 

Phase  8  -  This  phase  occurs  at  the  end  of  the  day.  The  submersible  is  towed  to  the 
dock  or  maintenance  facility.  The  other  vessels  also  return  and  final  internal  and 
external  checks  are  made  of  the  submersible  by  the  vessel  crew.  Checks  are  also 

made  of  the  surface  vessel  equipment.  A  post-dive  brief  is  completed  by  all 

operating  personnel,  problems  are  identified,  logs  and  other  records  are  completed, 
and  necessary  maintenance  is  assigned  and  performed. 

3. 4.1. 3  Documentation  Procedures 

As  applicable,  checklists  of  operational  tests,  system  status,  communication,  and 
maintenance  logs,  and  other  records  are  completed  and  signed  by  appropriate 
submersible,  support  vessel,  and  maintenance  personnel  after  each  dive  and  on  a 
daily  basis. 

3. 4. 1.4  Communication  Procedures 

The  submersible  vessel  initiates  or  returns  communications  with  the  surface  support 
vessel  at  10  to  15  minute  time  intervals,  and  requests  clearance  to  surface  at  the  end 
of  the  dive  (or  for  emergency  ascent). 

For  each  dive,  the  surface  support  vessel  verifies  the  operation  of  the  underwater 
telephone,  provides  the  submersible  with  clearance  to  open  and  close  hatches, 
clearance  to  open  or  close  air  ballast  vents,  and  clearance  and  heading  for  the 
submersible  to  dive  or  surface.  The  surface  support  vessel  initiates  or  returns 
communications  with  the  submersible  vessel  every  10  to  15  minutes.  If  the 
submersible  does  not  receive  any  contact  from  the  surface  support  vessel  for  more 
than  20  minutes,  the  pilot  tries  once  more  to  reestablish  contact.  If  that  fails,  the 
submersible  pilot  aborts  the  dive  and  returns  to  the  surface. 
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The  surface  taxi  vessel  maintains  contact  with  the  surface  support  vessel  at  all  times 
while  at  the  dock  and  en  route  to  the  dive  site.  The  taxi  vessel  also  informs  the 
support  vessel  of  the  passenger  count  and  estimated  time  of  arrival  for  each  trip  to 
the  dive  site.  After  boarding  of  passengers  is  completed,  the  taxi  vessel  radios  its 
heading  prior  to  proceeding  back  to  the  dock. 

3.4.2  Maintenance  Procedures 

Scheduled  and  specific  procedures  are  followed  for  repairs,  modifications, 
replacement  of  equipment,  removal,  and  any  other  routine  maintenance  for  the 
submersible  or  surface  vessels. 

3.4.3  Emergency  Procedures 

Various  types  of  emergency  situations  could  occur,  involving  the  submersible  itself, 
or  one  or  both  of  the  surface  support  vessels.  Submersible  emergency  situations 
could  involve: 

o  Collision  (underwater  or  surface), 

o  Entanglement, 

o  Fire, 

o  Flooding, 

o  Loss  of  power, 

o  Passenger  illness, 

o  Loss  of  air  in  ballast/trim  system, 

o  Stranded  on  bottom, 

o  Emergency  or  uncontrolled  ascent, 

o  Oxygen  leak/C02  removal  system  failure,  and 

o  Loss  of  communication. 

For  specific  submersible  emergency  situations,  predetermined  procedures  for 
emergency  communications,  abort  of  dive,  and  use  of  emergency  equipment  are 
followed  by  the  crew  as  appropriate  on  each  vessel,  to  safeguard  the  safety  of 
submersible  vessel  passengers  and  crew,  and  to  ensure  their  rescue/evacuation  from 
the  vessel  and  safe  return  to  shore.  Although  the  submersible  pilot  normally 
requests  clearance  from  the  surface  support  vessel  to  ascend,  the  pilot  may  abort  the 
dive  and  surface  during  emergency  conditions. 
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The  surface  vessels  may  develop  an  emergency  situation  (i.e.,  crew  illness,  fire, 
collision,  change  of  sea  state  and  other  weather  conditions).  Crews  of  each  vessel 
again  follow  predetermined  emergency  procedures  applicable  to  each  situation. 


3.5  PEOPLE 

The  final  element  of  the  passenger  submersible  system  consists  of  people,  including 
company  personnel  and  passengers. 

3.5.1  Company  Personnel 

3. 5.1.1  Duties 

Company  personnel  have  different  duties  and  authority  depending  on  their 
assigned  responsibilities.  The  General  Manager  is  the  person  in  charge  of  all  aspects 
of  the  local  operation,  including  sales,  advertising,  financial,  etc.  The  Operations 
Manager  is  responsible  for  the  day-to-day  operation  of  the  submersible  and  surface 
vessel  operations.  Other  staff  sell  tickets  and  assist  passengers  in  boarding  the 
passenger  taxi  ship,  and  perform  necessary  maintenance  and  repair. 

Company  personnel  directly  involved  with  operations  are  the  submersible  crew,  the 
crew  for  the  surface  taxi  ship  vessel  which  transports  passengers  to  the  dive  site,  and 
the  crew  for  the  surface  support  vessel  which  provides  dive  site  support  (i.e.,  assist  in 
loading  passengers  on  and  off  the  submersible,  maintain  communications,  track  the 
submersible  ,  protect  the  dive  site  area,  etc.) 

Submersible  Personnel 

The  minimum  submersible  personnel  consists  of  a  pilot  and  copilot.  The  pilot 
operates  the  vessel  while  it  is  submerged.  The  copilot  assists  the  pilot  in  the 
operation  of  the  vessel,  provides  explanations  of  underwater  attractions  to 
passengers,  and  provides  other  assistance  as  necessary.  The  copilot  is  capable  of 
taking  over  submersible  operations. 

Surface  Vessel  Personnel 

The  surface  (support  and  taxi)  vessels  each  have  a  captain  and  a  deckhand.  The 
surface  vessels  are  operated  under  the  direction  of  a  captain  with  the  assistance 
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of  deckhands.  The  captain  of  the  surface  support  vessel  is  designated  as  having 
overall  control  of  all  company  vessels  at  the  dive  site. 

Rescue/Recovery  Personnel 


Qualified  divers  or  other  personnel,  knowledgeable  in  the  operation  of  emergency 
equipment,  should  be  either  available  on  the  surface  vessels  or  at  shore  facilities. 

3.5.1 .2  Qualifications  and  Experience 

The  pilot  and  copilot  of  the  submersible  have  completed  the  company  training 
program.  The  pilot  has  obtained  submersible  operating  experience  while  serving  as 
a  copilot.  The  submersible  crew  is  familiar  with  the  area  of  the  operating  site. 
Support  personnel  also  have  completed  the  company  training  program. 

Submersible  personnel  are  certified  by  the  Coast  Guard.  In  addition,  applicable 
Coast  Guard  regulations  regarding  licensing,  training,  and  manning  requirements 
for  the  surface  vessels  are  followed. 

3.5.1. 3  Training 

Initial  classroom  and  practical  training  in  the  proper  operation  of  the  submersible 
and  other  vessel  operations  is  provided  to  appropriate  personnel.  Refresher  training 
is  provided  on  an  annual  basis  to  all  personnel.  Separate  training  in  how  to  respond 
to  emergency  situations,  including  emergency  procedures  and  operation  of 
emergency  equipment  is  provided  as  part  of  the  initial  and  refresher  training. 

3.5.2  Passengers 

Passengers  who  travel  on  the  submersible  are  persons  who  probably  have  never 
been  on  a  submarine  before.  They  do  not  necessarily  know  how  to  swim.  Passenger 
age  can  vary  and  some  passengers  may  have  disabilities  such  as  hearing  loss,  heart 
disease,  shortness  of  breath,  etc.  The  number  of  passengers  varies  (see 
Environment). 
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4.  HAZARD  IDENTIFICATION 


Having  defined  the  system,  the  next  step  in  the  hazard  resolution  process  is  the 
identification  of  potential  hazards.  When  identifying  the  safety  hazards  present  in  a 
system,  a  major  concern  is  what  portion  of  the  total  number  of  system  hazards  has 
been  identified.  The  quality  or  type  of  hazard  analysis  will  greatly  influence  the 
total  number  of  hazards  identified. 

4.1  HAZARD  IDENTIFICATION  APPROACH 

There  are  four  basic  methods  of  hazard  identification  that  may  be  employed  to 
identify  hazards.  These  methods  are: 

o  Data  from  previous  accidents  (case  studies)  or  operating  experience, 

o  Judgment  of  knowledgeable  individuals  and  scenario  development, 

o  Generic  hazard  checklists,  and 

o  Formal  hazard  analysis  techniques. 

4.1.1  Data  from  Previous  Accidents 

Examination  of  previous  accident  experience  can  provide  an  insight  into  what  has 
happened  in  the  past.  Passenger  carrying  submersibles  (for  the  tourist  trade)  have 
been  operating  in  the  Caribbean  and  the  Pacific  Ocean  for  the  last  5  years.  This 
operating  experience  (exposure)  of  passenger  carrying  submersibles  has  not  resulted 
in  the  occurrence  of  any  deaths  or  serious  injuries.  Therefore,  information  from 
other  data  sources  for  other  types  of  submersible  usage  and  military  submarines  was 
reviewed  to  gain  an  insight  into  the  kinds  of  potential  emergency  situations  which 
could  occur. 

Insight  into  emergency  situations  involving  industrial/research  submersibles  is 
provided  in  references  5  and  6.  Although  much  of  the  military  experience  has  been 
classified,  reference  7  provides  an  excellent  insight  into  peacetime  submarine 
accidents.  In  the  case  of  commercial  research  and  industrial  submersibles,  there  have 
been  very  few  accidents.  The  low  accident  experience  is  due  in  large  part  to  the 
good  operating  practices  of  the  submersible  industry.  Moreover,  the  limited  data 
available  is  insufficient  to  provide  a  thorough  understanding  of  the  variety  of 
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potential  hazards  that  may  occur  in  submersible  operations.  In  addition, 
identification  of  hazards  solely  through  review  of  previous  accident  data  or 
experience  is  not  a  satisfactory  approach  because  identified  hazards  will  be  limited 
only  to  previous  accidents  while  new  and  future  hazards  will  not  be  identified. 

4.1.2  Expert  Opinion  and  Hazard  Scenarios 

Judgment  by  knowledgeable  individuals  was  used  to  provide  a  starting  point  for  the 
identification  of  the  types  of  emergency  situations  or  "undesirable  events,"  which 
can  occur.  To  assist  m  understanding  the  mechanism  by  which  accidents  occur, 
hazard  scenarios  have  been  developed.  These  scenarios  briefly  outline  potential 
situations  and  equipment  malfunctions  which  could  impact  on  the  safety  of  the 
submersible  and  the  persons  onboard.  Scenarios  include  selected  undesirable  events 
(i.e.,  air  contamination,  fire,  inability  to  surface,  etc.)  and  a  summary  of  possible 
causes  and  results.  The  scenarios  are  intended  to  represent  potential  real-world 
events  and,  as  such,  have  been  derived  primarily  from  the  experiences  of 
research/industrial  submersibles  and  military  submarines. 

The  seven  scenarios  developed  which  represent  typical  submersible  emergency 
situations  are  categorized  as  follows: 

o  Flooding, 

o  Inability  to  ascend  or  descend, 
o  Fire, 

o  Collision, 

o  Vessel  isolation, 

o  Air  contamination,  and 

o  Passenger  injury/illness. 

A  complete  description  of  the  scenarios  is  contained  in  Appendix  A.  Each  of  these 
types  of  emergency  situations  may  be  the  result  of  a  number  of  hazards  and  causal 
effects  that  involve  a  variety  of  events  or  conditions.  Although  a  number  of 
potential  hazards  and  causal  effects  were  identified,  this  initial  effort  identified  only 
a  limited  portion  of  the  hazards  that  may  exist.  The  scenarios  were  also  of  limited 
assistance  in  identifying  the  potential  for  future  accidents. 
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4.1.3  Generic  Checklists 

Generic  checklists  may  also  be  used  to  identify  potential  hazards.  With  this 
approach,  the  depth  of  detail  and  applicability  of  the  hazard  checklists  has  an  impact 
on  the  quality  and  quantity  of  hazards  identified.  Appendix  B  contains  a  generic 
checklist  which  groups  hazards  within  the  categories  of  basic  design  deficiencies, 
malfunctions,  maintenance,  environmental,  and  human  factors. 

4.1.4  Formal  Analysis 

A  number  of  formal  analysis  methods  are  available  for  use  in  identifying  hazards. 
The  following  sections  present  the  two  formal  analysis  methods  which  were 
employed  to  identify  hazards  associated  with  passenger  carrying  submersibles. 

4.2  PRELIMINARY  HAZARD  ANALYSIS 

Preliminary  Hazard  Analysis  (PHA)  is  a  basic  hazard  analysis  technique  used  to 
identify  hazards.  The  PHA  is  an  inductive  analysis  technique  which  uses  the  bottom 
up  approach  (what  happens  if  this  hazard  exists)  to  det'-'mine  what  the  effect  of  a 
system  event  or  system  malfunction  will  be.  The  PHA  format  provided  an  organized, 
systematic  framework  to  follow  in  presenting  potential  hazards,  causes, 
recommendations,  and  hazard  control  references.  A  key  point  concerning  this 
analysis,  as  used  for  this  report,  is  that  it  provides  a  checklist  and  opportunity  to 
consider  a  large  number  of  potential  hazards;  some  of  which,  however  improbable, 
could  occur.  This  is  important  because  historical  data  and  experience  do  not 
necessarily  reflect  all  potential  safety  hazards  and  their  effects. 

4.2.1  PHA  Development 

The  PHA  is  based  on  the  passenger  carrying  submersible  system  contained  in  the 
system  definition  presented  in  Section  3  of  this  report.  The  PHA  has  been  developed 
using  the  organizational  approach  shown  on  Figure  4-1.  The  three  main  elements  of 
the  submersible  system  are:  Submersible,  Surface/Shore,  and  General.  Figure  4-1 
also  contains  an  organizational  chart  which  presents  the  functional  areas  analyzed 
for  each  of  the  main  elements.  These  functional  areas  are: 
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FIGURE  4-1.  PHA  ORGANIZATION 


o  Ship  control, 

o  Systems, 

o  Surface  vessels, 

o  Shore  facilities, 

o  Documentation, 

o  People,  and 

o  Environment. 

Potential  hazards  and  causes  were  identified  for  each  of  the  systems  and  subsystems 
within  the  functional  areas.  Hazards  were  identified  utilizing  a  review  of  the 
available  literature,  hazard  scenarios  described  in  Appendix  A,  and  the  generic 
checklist  contained  in  Appendix  3;  and  discussions  with  persons  knowledgeable 
about  submersible  equipment  and  operations. 

PHA  worksheets  were  prepared  which  list  the  following : 

o  Hazard  description, 

o  Potential  causes, 

o  Potential  effects, 

o  Risk  Assessment  Category, 

o  Hazard  Risk  Index, 

o  Recommended  action  for  corrective  actions, 

o  Effect  of  recommendation, 
o  Hazard  control  references  (where  available),  and 

o  Notes. 

Figure  4-2  is  an  example  of  a  PHA  worksheet  and  is  explained  in  the  following  text. 
The  control  number  for  each  line  item  is  contained  in  the  first  column.  This  number 
identifies  the  line  item  and  is  derived  from  the  combination  of  numbers  assigned  to 
each  of  the  systems,  subsystems,  and  hazard  descriptions.  Where  there  is  more  than 
one  causal  factor  for  a  specific  hazard  description,  each  of  the  causal  factors  is 
assigned  a  letter.  For  the  example  illustrated,  the  control  number  1.1. 01A  results 
from  the  combination  of  the  following :  1  for  the  Hull  system,  .  1  for  the  Pressure  Hull 
subsystem,  and  .01  for  the  hazard  description,  Implosion/Collapse.  The  A  indicates 
that  the  first  cause  (of  five  in  this  case)  of  the  hazard  is  Improper  Design.  The  second 


column  of  the  PHA  worksheet  contains  a  brief  description  of  each  hazard  while  the 
potential  causes  are  noted  in  the  third  column.  The  fourth  column  describes  the 
potential  effect  of  the  specific  hazard,  in  this  case,  Flooding.  The  fifth  column 
contains  the  Risk  Assessment  Category  (RAC)  and  the  Hazard  Risk  Index  (HRI)  value 
assigned  to  each  hazard.  (Refer  to  Figure  2-4)  The  RAC  represents  the  hazard  risk  in 
terms  of  both  the  severity  and  probability  (e.g.,  ID  indicates  the  hazard  is 
"Catastrophic"  and  "Remote").  The  RACs  are  grouped  into  four  numerical  HRI 
categories.  The  HRI  value  (e.g.,  1  =  Unacceptable)  is  used  to  actually  determine 
what  management  action  is  necessary.  The  RAC  and  HRI  are  a  subjective  judgment 
open  to  other  opinion  since  adequate  data  is  unavailable  to  actually  determine  the 
probability.  The  recommendations  presented  in  column  six  of  the  PHA  worksheets 
describe  methods  which  may  be  employed  to  either  eliminate  the  cause  or  minimize 
the  effect  of  each  hazard.  One  or  more  recommendations  are  listed  for  each  of  the 
hazard  causes  identified.  Many  recommendations  are  based  on  existing  rules, 
regulations,  and  guidelines.  The  effect  of  the  recommendation  in  terms  of  changing 
the  RAC  and  HRI  is  presented  in  column  seven.  (Note:  This  second  RAC  and  HRI 
reflect  a  reduction  in  probability,  but  not  severity  ).  The  eighth  column  lists  the 
applicable  sections  of  regulations,  rules,  and  guidelines  which  were  used  as 
reference  sources  for  the  recommendations.  In  cases  where  no  reference  was 
located,  the  term  TBD  (To  be  Determined)  was  used.  The  ninth  column,  "Notes," 
was  used  to  indicate  whether  hazards  were  considered  time  dependent. 

Hazard  control  references  included  applicable  sections  of  the  Code  of  Federal 
Regulations,  Parts  46  and  33,  ABS  Rules  for  Building  and  Classing  Underwater 
Systems  and  Vehicles,  ASME/ANSI  Safety  Standard  for  Pressure  Vessels  for  Human 
Occupancy,  publications  of  the  Marine  Technology  Society,  U.S.  Navy  Systems 
Certification  Procedures  and  Criteria  Manual  for  Deep  Submergence  Systems,  and 
U.  S.  Coast  Guard  passenger  carrying  submersible  guidelines.  A  complete  listing  of 
the  reference  sources  is  contained  in  Appendix  C.  The  ninth  column,  "  Notes,”  was 
used  to  indicate  whether  hazards  were  considered  time  dependent. 

4.2.2  PHA  Findings 

The  PHA  effort  has  focused  primarily  on  the  identification  of  hazards  which  could 
result  in  the  following  undesired  events: 

o  Flooding, 

o  Fire/Explosion, 
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Air  Contamination, 
o  inability  to  surface/stay  submerged, 

o  Collision, 

o  Passenger/crew  injury,  or 

o  Inability  to  rescue  the  submersible. 

The  Preliminary  Hazard  Analysis  (PHA)  presented  in  Appendix  C  of  this  document 
identifies  more  than  140  potential  hazards  and  almost  500  potential  causes 
associated  with  the  30  subsystems  of  the  passenger  carrying  submersible  operation. 
Selected  hazards  are  briefly  reviewed  below.  Appendix  C  should  be  referred  to  for 
additional  details. 

4.2.2. 1  Submersible 

A.  Hull 

Examples  of  identified  hazards  associated  with  the  pressure  hull  which  could  result 
in  flooding  include  implosion/failure  and  leakage.  Leakage  at  hull  penetrations, 
(electrical,  mechanical,  and  piping),  viewports,  and  hatches,  though  time 
dependent,  could  also  result  in  flooding. 

B.  Ship  Control 

Hazards  related  to  ballast/trim  which  could  impact  on  the  ability  to  surface  or  remain 
submerged  (the  latter  is  important  to  avoid  collision  in  certain  cases)  include 
malfunction  or  failure  of  high  pressure  air  tanks  and  piping,  descending  below 
certified  test  depth,  or  the  inability  to  control  the  ascent/decent. 

Ballast/trim  hazards  also  include  instability  while  on  the  surface  or  submerged,  and 
inability  to  compensate  for  the  weight  of  passengers.  These  hazards  could  result  in 
passengers  falling  overboard  or  down  ladders,  the  submersible  rolling,  taking  on 
excessive  trim  angle,  orflooding  through  hatches  while  loading  passengers. 

Lack  of  or  loss  of  manual  or  automatic  piloting  controls  (including  depth  gauge, 
compass,  gyro,  trim  weight,  rudder  control,  etc.)  necessary  to  accurately  steer  the 
submersible  could  result  in  collision. 
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Propulsion  and  maneuvering  hazards  concern  the  inability  of  the  submersible  to 
move  vertically,  forward  and  aft,  or  port  and  starboard.  This  inability  to  maneuver 
could  result  in  collision  with  obstacles,  inability  to  surface/  remain  submerged,  or 
lack  of  movement  necessary  to  escape  entanglement. 

C.  Systems 

Hazards  such  as  insufficient  air  pressurization,  or  over-pressurization  could  result  in 
ballast/trim  problems  including  inability  to  surface  or  submerge. 

Insufficient  hydraulic  system  pressure  could  result  in  loss  of  steering  leading  to  a 
collision  or  inability  to  jettison  weight  to  surface.  Hydraulic  fluid  leakage  could  also 
result  in  passenger  falls,  air  contamination  or  fire,  as  well  as  collision  or  inability  to 
jettison  weight. 

A  major  electrical  hazard  is  the  loss  of  electrical  power  to  life  support  systems, 
propulsion,  lighting,  ballast/trim  controls,  etc.  This  lack  of  power  could  result  in 
collision,  air  contamination,  or  inability  to  surface/submerge.  Another  electrical 
hazard  of  particular  concern  is  the  battery  itself.  A  battery  explosion,  generation  of 
gases  such  as  stibine,  hydrogen,  chlorine  or  arsine,  and  lead  battery  acid  leakage, 
could  result  in  fire  or  air  contamination. 

Interior  and  exterior  lighting  hazards  include  inadequate  lighting  levels  or  the 
complete  loss  of  lighting.  This  could  result  in  insufficient  visibility  levels  necessary 
for  safe  piloting  during  underwater  or  surface  operation  and  could  also  result  in 
collision  or  passenger  falls. 

Communication  between  the  submersible  and  surface  vessels  is  vital  to  the  safe 
operation  of  the  submersible.  Communication  problems  involving  the  submersible 
underwater  telephone  or  VHF  radio  could  interfere  with  safe  operations  and  could 
result  in  collision.  Limited  visibility  due  to  the  position  of  the  pilot  control  console 
makes  the  pilot  dependent  on  the  continuous  communication  with  the  surface 
support  vessel  to  avoid  collision  with  the  support  vessel  or  other  surface  craft.  In 
addition,  if  air  contamination,  fire,  or  flooding  occurs,  surface  support  vessel 
personnel  can  advise  the  submersible  crew,  take  emergency  action  and/or  inform 
shore  facilities. 


Loss  of  oxygen  supply  and  buildup  of  CO2,  are  potential  life  support  hazards  which 
could  result  in  air  contamination.  Air  contamination  could  also  result  from 
inadequate  air  circulation,  loss  of  temperature/humidity  control,  or  refrigerant  or  oil 
leakage  Under-pressurization  of  the  cabin  interior  may  make  it  impossible  to  open 
hatches  and  evacuate  the  submersible.  Over-pressurization  of  the  cabin  interior 
could  result  in  passenger  inner  ear  injury. 

Certain  submersible  subsystems  may  have  an  impact  on  whether  the  occurrence  of 
certain  hazards  are  exacerbated  or  their  effects  are  controlled.  Failure  to  detect 
toxic  or  flammable  gas,  water  leakage,  or  ignition/smoke  are  hazards  which  could 
result  in  air  contamination,  flooding,  and  fire.  Another  hazard  could  include  the 
inability  to  pump  out  quantities  of  water  resulting  from  leakage/flooding.  Due  to 
the  confined  area  of  the  submersible  cabin  interior,  and  the  underwater  operation, 
it  is  necessary  to  extinguish  fires  immediately  using  an  extinguishing  agent  which 
does  not  itself  cause  air  contamination.  The  inability  to  surface  by  rapidly  blowing 
the  ballast  tanks  or  releasing  jettison  weight  could  prevent  the  submersible  from 
returning  to  the  surface  where  fire  fighting  or  medical  assistance  could  be  obtained. 
If  the  submersible  is  unable  to  surface  for  an  extended  period  of  time,  the  lack  of 
emergency  supplies  of  oxygen  or  CO2  absorbent  powder  may  result  in  air 
contamination. 

The  lack  of  an  emergency  power  supply  to  vital  systems  such  as  communications, 
propulsion,  lighting,  and  air  blowers  and  fans  could  result  in  collision,  inability  to 
surface,  air  contamination,  etc.  Should  passengers  fall  overboard,  or  need  to 
evacuate  the  sub,  the  lack  of  flotation  devices  (i.e.,  life  jackets,  buoyant  cushions, 
etc.)  could  result  in  passenger  drowning.  Finally,  the  submersible  could  be  unable  to 
surface,  lose  communications  with,  and  thus  become  isolated  from  the  surface 
support  vessel.  The  absence  of  a  locating  device  (i.e.,  marker  buoy,  sonar)  could 
prevent  rescuers  from  locating  the  submersible. 

4. 2. 2. 2  Surface/Shore 

A.  Surface  Support  Vessel 

A  collision  could  result  if  the  surface  support  vessel  loses  visual  sighting  and/or 
surface  or  underwater  communications  with  the  submersible.  If  the  surface  support 
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vessel  fails  to  keep  the  immediate  area  of  the  dive  site  clear  or  at  least  provide 
warning  to  other  surface  craft,  a  collision  could  occur.  The  lack  of  flotation  devices 
could  result  in  passenger  drowning  if  passengers  fall  overboard  or  need  to  evacuate 
from  the  submersible  into  the  water. 

B.  Passenger  Taxi  Vessel 

A  particular  hazard  concerns  the  direct  transfer  of  passengers  between  the 
passenger  taxi  vessel  and  the  submersible  at  the  dive  site.  Depending  on  the  transfer 
means,  level,  or  the  gap  between  the  vessel  decks,  passengers  could  fall  between  the 
two  vessels  and  be  crushed,  or  fall  overboard  and  drown. 

C.  Shore  Facilities 

Uneven  or  slick  docking  or  gangway  facilities  for  boarding  passengers  either  to  the 
passenger  taxi  vessel  or  directly  to  the  submersible  could  result  in  a  casualty  from 
falling  or  drowning.  Maintenance  personnel  may  not  have  adequate  access  to 
submersible  equipment  to  perform  required  maintenance.  This  could  lead  to 
equipment  problems,  which  could  result  in  flooding,  air  contamination,  etc. 
Maintenance  personnel  could  also  be  injured  if  "good  housekeeping"  is  not 
practiced  at  maintenance  facilities,  or  if  hydrogen  gas  reaches  critical  levels  during 
battery  charging. 

In  the  event  that  the  submersible  is  unable  to  surface,  the  lack  of  emergency 
equipment,  such  as  a  lift  crane,  cable  winch  assembly.  Remotely  Operated  Vehicles 
(ROV)  or  attachable  flotation  device  could  prevent  passenger  rescue. 

4.2. 2. 3  General 

A.  Documentation 

Undesired  events  such  as  flooding,  air  contamination,  collision,  fire,  etc.,  could  result 
if  proper  procedures  are  not  available  or  not  followed  during  passenger  transfer, 
normal  operation  of  the  submersible  (including  operation  of  the  life  support 
equipment),  and  maintenance.  Lack  of  or  incomplete  recordkeeping  to  ensure  that 
the  operations  and  maintenance  procedures  are  actually  carried  out  could  also 
permit  hazards  to  exist. 
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The  absence  of  or  inadequate  emergency  planning  and/or  specific  emergency 
procedures  to  follow  in  the  event  of  emergency  situations  could  aggravate 
hazardous  conditions  and  compound  the  difficulty  of  rescuing  passengers. 

B.  People 

Qualifications,  training,  and  manning  levels  are  major  hazard  areas  relating  to  the 
submersible  and  other  vessel  and  maintenance  personnel.  For  example,  the  lack  of 
qualifications  and  experience  could  prevent  or  hinder  personnel  from  carrying  out 
the  responsibilities  and  duties  necessary  for  the  safe  operation  of  the  submersible. 
The  lack  of  or  incomplete  training  could  lead  to  incorrect  decisions  or  actions  during 
normal  or  emergency  operations.  Inadequate  numbers  of  personnel  could  also 
result  in  problems  transferring  passengers  between  vessels,  assisting  passengers  in 
entering  the  submersible  or  otherwise  affect  the  safety  of  the  submersible  vessel. 

There  are  a  number  of  hazards  which  passengers  may  contribute  to  or  create.  For 
example,  a  passenger  may  panic  because  of  claustrophobia  or  require  medical 
attention.  Passengers  could  also  deliberately  reach  out  or  accidentally  brush  against 
submersible  equipment  controls.  Slips  and  falls  could  result  from  passengers 
wearing  footwear  which  catches  on  the  deck  or  ladder  or  makes  movement 
unsteady.  Passengers  could  carry  firearms  or  other  dangerous  items  aboard,  or 
release  toxic  or  pressurized  gases,  leading  to  fire  or  air  contamination.  If  passengers 
do  not  know  how  to  swim,  emergency  evacuation  from  the  submersible  into  the 
water  may  result  in  drowning  if  there  is  no  means  of  rescue. 

C.  Environment 

The  weather  and  marine  conditions  at  the  submersible  dive  site  can  present  hazards 
during  operations.  A  sudden  rainstorm  or  fog  can  reduce  visibility.  High  wind  can 
affect  the  sea  dynamics  in  terms  of  wave  action  and  sea  state  resulting  in  flooding 
through  open  hatches  and  potential  passenger  falls  during  loading/unloading. 
Strong  currents  (both  subsurface  and  surface)  could  affect  the  steering  of  the 
submersible  and  thus  result  in  collision  with  another  surface  vessel  or  underwater 
obstacle.  The  current  could  also  cause  undesirable  separations  from  the  surface 
support  vessel. 
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Depending  on  the  underwater  terrain  and  contour  (i,e.,  overhangs,  narrow  sea 
canyon  walls,  etc.),  a  collision  or  grounding  could  result.  If  the  submersible  drifts  or 
becomes  lost,  a  sharp  drop  in  sea  bed  slope  near  the  dive  site  could  permit  the 
submersible  to  descend  below  its  certified  depth.  Decreased  buoyancy  as  a  result  of 
the  increase  in  depth  pressure  could  result  in  the  inability  to  surface.  Water  leakage 
and  the  inability  to  operate  controls  could  also  occur.  The  depth  could  also  impact 
on  the  ability  of  a  diver  to  assist  the  submersible  or  could  prevent  a  crane  from  being 
able  to  lift  it  to  the  surface  for  rescue. 

Hazards  such  as  cables,  shipwrecks,  or  sea  plant  growth  could  result  in 
entanglement.  Aggressive  marine  life  could  attack  the  submersible,  panicking 
passengers,  or  damaging  equipment.  An  abandoned  pressure  vessel  or  abandoned 
explosive  could,  if  not  identified  and  removed  from  the  site,  explode  and  damage 
the  submersible  preventing  it  from  surfacing. 

A  sudden  disturbance  of  the  sea  bed  bottom  could  result  in  loss  of  visibility  and 
increase  the  possibility  of  collision.  A  sudden  change  in  water  temperature  could 
result  in  sudden  loss  of  control  or  ascent/descent  of  the  submersible. 

The  materials  which  comprise  the  interior  of  the  submersible  cabin  could  present  fire 
safety  hazards  to  passengers.  In  the  event  of  a  fire,  the  flammability  and  smoke  or 
toxic  gas  emission  characteristics  of  seats,  wall  panels,  wire  and  cabling  insulation, 
etc.,  could  contribute  to  the  rapid  spread  of  fire  or  air  contamination. 

Sharp  objects  or  edges,  low  aisle  height,  or  slick  cabin  floors  could  result  in  passenger 
injury  and  falls.  A  steep  vertical  cant  of  the  ladder,  lack  of  railing  or  slick  surface  of 
the  rungs  could  result  in  passenger  unsteadiness  and  a  fall.  If  not  stowed  securely, 
the  access  ladder  could  fall  and  result  in  passenger  injury. 

4.3  FAULT  TREE  ANALYSIS  (FT A) 

A  fault  tree  is  a  graphical  representation  of  the  relationship  between  certain  specific 
events  and  an  ultimate  undesired  event. 

FTA  is  a  deductive  analysis  technique  which  uses  the  top  down  approach  (what 
and/or  why  did  a  particular  event  happen)  to  determine  the  possible  causes  of  an 
undesired  event  or  system  failure. 
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Fault  tree  analysis  was  chosen  as  one  of  the  principal  tools  for  identifying  hazards 
because  it  is  a  systematic  method  of  analyzing  the  complex  series  of  events  which 
occur  during  an  accident.  Each  event  or  sequence  of  events  can  also  be  examined  to 
identify  appropriate  countermeasures.  Fault  tree  diagrams  can  and  should  be  used 
in  the  following  manner: 

o  As  an  educational  tool  to  fully  explain  how  an  accident  occurs  and  all 
the  contributing  factors, 

o  As  an  aid  in  developing  vessel  procurement  specifications, 

o  As  an  aid  or  checklist  for  the  vessel  designer, 

o  As  an  aid  in  developing  vessel  preventive  maintenance,  repair  and 
operational  practices,  and 

o  As  an  aid  in  developing  emergency  response  and  evacuation 
procedures. 

4.3.1  Fault  Tree  Development 

A  typical  fault  tree  diagram  is  constructed  as  follows.  A  particular  undesired  event  is 
selected.  This  head  undesired  event  is  the  event  whose  occurrence  must  be 
minimized  or  prevented.  Primary  undesired  events,  and  their  interactions  and 
causes,  leading  to  the  undesired  head  event  are  then  examined  and  broken  down 
into  secondary  undesired  events  and  causes.  This  reverse  reasoning  process 
continues  until  there  is  either  insufficient  information  or  an  event  is  not  considered 
significant  gnough  for  further  analysis.  Various  symbols  are  used  to  represent  the 
relationship  between  certain  specific  events  and  the  ultimate  undesired  event  (see 
Figure  4-3)  An  example  of  a  simple  fault  tree  for  the  undesired  event  "Fire  "  is 
illustrated  in  Figure  4-4.  Fuel,  oxygen,  and  heat  (ignition  source)  are  aM  necessary  for 
the  fire  event  to  occur,  hence  the  presence  of  the  "And"  gate;  if  one  is  missing,  the 
fire  cannot  occur.  In  contrast,  the  use  of  an  "Or"  gate  would  indicate  that  only  one 
of  any  of  the  three  causes:  fuel  or  oxygen  or  heat,  would  be  required  for  a  fire  to 
occur. 

A  review  of  the  available  literature,  hazard  scenarios  described  in  Appendix  A,  and 
the  generic  checklist  contained  in  Appendix  B;  and  discussions  with  persons 
knowledgeable  about  submersible  equipment  and  operations,  were  used  to  assist  in 
the  development  of  the  fault  tree  diagrams. 
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RCFEHS  TO  ANOTHER 
BRANCH  DEVELOPED  IN 
ANOTHER  LOCATION  ON 
THE  FAULT  TREE. 


FIGURE  4-3.  FAULT  TREE  SYMBOLS 


FIGURE  4-4.  FIRE  FAULT  TREE  EXAMPLE 


FIGURE  4-5.  SUBMERSIBLE  PASSENGER/CREW  CASUALTY 
OCCURS  FAULT  TREE 

The  qualitative  fault  trees  developed  for  this  report  provide  overall  pictorial 
diagrams  leading  to  the  head  undesired  event:  "Submersible  Passenger/Crew 
Casualty  Occurs,"  (see  Figure  4-5).  This  casualty  could  occur  either  while  the 
submersible  is  on  the  surface  or  while  it  is  submerged.  The  surface  casualty  could 
occur  either  during  transfer,  entering  the  submersible,  or  inside  the  submersible.  To 
have  a  casualty  while  the  submersible  is  submerged,  two  events  must  both  occur. 
First,  an  emergency  condition  must  exist,  and  second,  the  individual  must  be  unable 
to  escape  from  the  emergency. 

Emergency  conditions  are  undesired  events  and  include  conditions  such  as  flooding, 
air  contamination  or  fire,  inability  of  the  submersible  to  ascend/descend,  collision, 
sub  isolation,  and  illness/injury.  Each  of  these  undesired  events  is  examined  from  the 
point  where  the  condition  occurs  and  the  condition  is  not  being  controlled.  The 
main  branch  leading  to  the  "Individual  does  not  Escape  from  Emergency 
Conditions"  focuses  on  the  causes  why  the  individual  does  not  escape  from  the  sub 
or  why  the  individual  is  not  rescued  from  the  sub. 

A  summary  of  the  undesirable  top  level  events  is  listed  in  Tables  4-1  and  4-2.  The 
complete  fault  tree  diagrams  are  contained  in  Appendix  D. 


4-16 


TABLE  4-1.  SUMMARY  OF  UNDESIRABLE  EVENTS  - 
CASUALTY  OCCURS  WHILE  SUBMERSIBLE  IS  ON  SURFACE 


CASUALTY  OCCURS  DURING  TRANSFER 

INDIVIDUAL  FALLS 

o  Individual  Falls  on  Deck 
o  Individual  Falls  Overboard 
o  Individual  Swept  Overboard 

INDIVIDUAL  IS  NOT  RESTRAINED  OR  ASSISTED 

CASUALTY  OCCURS  ENTERING  SUB 

INDIVIDUAL  FALLS 

o  Individual  Falls  from  Ladder 
o  Individual  Hits  Head 

INDIVIDUAL  IS  NOT  RESTRAINED  OR  ASSISTED 
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TABLE  4-2.  SUMMARY  OF  UNDESIRABLE  EVENTS  - 
CASUALTY  OCCURS  WHILE  SUBMERSIBLE  IS  SUBMERGED 

EMERGENCY  CONDITIONS  EXIST 

HAZARDOUS  CONDITIONS  ARE  PRESENT 
o  Flooding  Conditions  Exist 

-  Flooding  Occurs 

-  Flooding  is  not  Controlled 

o  Air  Contamination  Conditions  Exist 
-Toxic  Gas  Buildup  Occurs 

-  Toxic  Gas  is  not  Controlled 
o  Fire/Smoke  Conditions  Exist 

-  Fire/Smoke  Occurs 

-  Fire/Smoke  is  not  Controlled 

POWER  FAILURE 

SUB  CANNOT  ASCEND/DESCEND 

o  Sub  is  Unable  to  Ascend/Descend 
o  Attempt  by  Sub  to  Ascend/Descend  Fails 

COLLISION  OCCURS 

o  Collision  Occurs  Between  Sub  and  Other  Vessel 
o  Collision  Occurs  Between  Sub  and  Obstacle 

SUB  IS  ISOLATED  FROM  SURFACE  SUPPORT  VESSEL 

ILLNESS/INJURY  OCCURS 

INDIVIDUAL  DOES  NOT  ESCAPE  FROM  EMERGENCY  CONDITIONS 

PASSENGER/CREW  CANNOT  LEAVE  SUB 

o  Passenger/Crew  Cannot  Escape  from  Sub 

-  Individual  does  not  Take  Timely  Action 

-  Egress  is  Impossible 

o  Individual  is  not  Rescued  from  Sub 

-  Assistance  is  Unavailable 

-  Assistance  is  Unable  to  Take  Timely  Action 

INDIVIDUAL  DROWNS  AFTER  LEAVING  SUB 
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4.3.2  Fault  Tree  Findings 

The  undesired  events  depicted  in  the  fault  tree  diagrams  closely  parallel  those 
identified  in  the  hazard  scenarios  and  the  PHA.  While  the  causes  of  the  undesired 
events  in  the  fault  trees  are  identified  more  fully  than  in  the  scenarios,  the  causes  are 
not  covered  to  the  extent  that  they  are  listed  in  the  PHA.  This  is  because  the 
emphasis  of  the  fault  tree  diagrams  is  to  identify  and  present  the  progression  and 
combination  of  potential  events,  hazards,  and  causes  which  could  lead  to  a 
passenger  submersible  casualty.  Moreover,  the  format  of  the  fault  tree  diagrams 
illustrates  the  importance  of  the  relationships  between  the  events. 

A  review  of  the  fault  tree  diagrams  shows  that  a  passenger/crew  casualty  could  occur 
either  while  the  submersible  is  on  the  surface  or  while  it  is  submerged.  This  is  an 
important  point  for  two  reasons.  First,  certain  events  and  hazards  which  could  result 
in  a  casualty  could  occur  while  the  submersible  is  on  the  surface,  particularly 
passenger  falls.  This  perspective  has  thus  been  expanded  beyond  the  more  obvious 
or  dramatic  types  of  problems  which  could  occur  while  the  submersible  is 
submerged.  As  a  result,  the  characteristics  of  the  passenger  submersible  operation 
which  make  up  this  "dual  aspect  of  operation"  are  addressed.  Second,  both  the 
severity  of  the  potential  hazard  and  the  necessary  level  of  emergency  response 
effort  will  vary  widely  depending  on  the  location  of  the  submersible  during  an 
emergency. 

While  the  prevention  of  as  many  hazards  as  practical  is  desirable  from  a  safety 
standpoint,  certain  hazards  are  either  inherent  to  the  operation  of  the  system  or 
cannot  be  completely  eliminated.  Thus,  a  significant  element  of  the  fault  trees  is  the 
indication  of  "And"  gates  to  signify  a  double  point  hazard  at  high  levels  of  the  fault 
tree  diagram.  That  is,  an  undesired  event  exists  and  it  is  not  controlled  or  responded 
to  in  some  way.  As  an  example,  a  passenger  falis,  and  is  not  restrained  or  assisted. 
Again,  flooding  conditions  exist  because  both  flooding  occurs  and  the  flooding  is 
not  controlled.  Passenger  falls,  flooding,  air  contamination,  fire,  and  and  inability 
of  the  submersible  to  surface  are  the  events  which  were  extensively  developed  to 
illustrate  this  double  point  hazard  concept.  The  branch  of  the  fault  tree  illustrating 
fire/smoke  suppression/containment  was  considered  a  particularly  important  control 
area  to  examine  because  of  the  confined  environment  of  the  submersible. 
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The  fault  tree  diagrams  depicting  the  actions  and  facilities  pertaining  to  passenger 
escape  and  rescue  from  emergency  conditions  illustrate  some  key  points  relating  to 
passenger  safety.  Proper  advance  planning,  provision  of  pre-determined 
emergency  procedures,  adequate  and  frequent  training,  and  availability  of 
emergency  equipment  all  contribute  greatly  to  the  success  of  swift,  effective 
emergency  response  operations. 
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5.  RISK  ASSESSMENT 


The  results  of  the  hazard  identification  process  have  been  described  in  Section  4. 
This  process  resulted  in  the  identification  of  several  typical  undesired  events  that 
may  result  in  a  submersible  passenger  or  crew  casualty.  These  undesired  events  are 
as  follows: 

o  Flooding/leakage, 

o  Collision, 

o  Fire/explosion, 

o  Air  contamination, 

o  Inability  to  ascend  or  descend, 

o  Unable  to  rescue  submersible,  and 

o  Vessel  isolation 

Associated  with  each  of  these  undesired  events  are  potential  hazards  and  causal 
factors.  In  total,  more  than  140  hazards  and  almost  500  causal  factors  were 
identified  Each  of  the  undesired  events  could,  if  the  appropriate  countermeasure  is 
not  taken,  result  in  a  passenger/crew  casualty  or  loss  of  the  submersible. 
Furthermore,  each  undesired  event  may  occur  or  be  a  result  of  one  or  more  hazards 
and  causal  effects  that  involve  one  or  more  of  the  submersible  systems  or 
subsystems.  Within  the  PHA,  the  hazards  and  causal  factors  were  identified  for  the 
elements,  systems,  and  subsystems  of  the  passenger  submersible  operation  To 
adequately  address  the  safety  of  submersibles  requires  that  each  system  and 
subsystem  be  examined  and  the  appropriate  action  taken  to  mitigate  the  occurrence 
of  the  undesired  event. 

Due  to  the  large  number  of  hazards  and  causal  factors,  it  was  not  possible  to  assess 
in  detail  each  of  the  potential  hazards  and  causal  factors  identified  in  the  PHA.  The 
hazard  assessment  values  contained  in  the  PHA  are  of  a  subjective  nature  in  the 
absence  of  quantitative  data  As  operating  experience  is  accumulated,  the  assigned 
hazard  assessment  values  can  be  adjusted  to  more  realistically  reflect  the  severity 
and  probability  of  the  hazards.  The  following  sections  address  the  assessment  of  the 
undesired  events.  The  results  of  this  assessment  provide  guidance  on  the  safety 
needs  of  the  individual  submersible  systems  and  subsystems. 
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5.1  UNDESIRED  EVENT  SEVERITY  AND  PROBABILITY  ESTIMATES 


As  a  means  of  establishing  an  understanding  of  the  risk  associated  with  submersible 
operations  and  the  countermeasures  that  may  be  employed  to  address  those  risks, 
the  undesired  events  have  been  assessed  for  severity  and  probability  of  occurrence. 
This  effort  is  subjective  but  can  provide  an  indication  of  which  undesired  events  pose 
the  largest  threat  to  passenger  casualties  and  submersible  loss.  Understanding  this 
will  assist  in  determining  which  of  the  available  countermeasures  may  be  employed 
to  address  those  threats. 

To  assist  in  establishing  event  severity  and  probability  of  occurrence  categories,  the 
hazard  categories  presented  in  MIL-STD-  882B  have  been  modified  to  address  the 
specific  undesired  events  associated  with  passenger  carrying  submersibles.  Figures 
5-1  and  5-2  present  these  modified  severity  and  probability  categories. 

5.1.1  Severity  of  Undesired  Event 

The  severity  or  magnitude  of  the  consequences  of  an  undesired  event  will  depend 
on  the  following  factors,  first,  when  the  event  occurs  in  the  operating  cycle  (surface, 
submerged,  etc  );  second,  whether  the  event  is  time  dependent  (leakage  vs. 
flooding,  etc.)  and  finally,  whether  it  can  be  controlled  (pumping).  For  the  purpose 
of  the  assessment  presented  here,  the  number  of  undesired  events  has  been 
expanded  to  include  several  intermediate  events  and  the  operating  cycle  has  been 
defined  as  follows: 

o  Passenger  transfer  to  submersible, 
o  Pre-dive  just  before  closing  hatch  to  descend, 

o  Descending  and  ascending,  and 

o  Submerged  touring. 

Estimates  of  the  severity  associated  with  these  undesired  events  which  could  involve 

the  submersible  operation  and  its  passengers/crew  are  contained  in  Table  5-1.  It  is 
recognized  that  the  severity  of  the  individual  event  may  vary  considerably.  However, 
for  the  purposes  of  this  study,  the  most  severe  consequence  has  been  postulated. 
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CATEGORY 


SEVERITY 


CHARACTERISTICS 


CATASTROPHE 

Death  to  passenger  or  employee,  loss  of  submersible. 

CRITICAL 

Severe  injury  to  passenger  or  employee,  hazard  or  single 
point  failure  may  lead  to  catastrophe  if  action  is  not 
taken  to  control  situation  or  rescue  individual.  Critical 
systems  are  involved  and  submersible  unable  to  surface. 
Time  of  response  is  important  in  preventing  death  or 
submersible  loss. 

MARGINAL 

Minor  injury  not  requiring  hospitalization  or  the  hazard 
present  does  not  by  itself  threaten  the  safety  of  the 
submersible  or  passengers.  No  critical  systems  are 
disabled,  but  could  oe  if  additional  failuie(s)/ 

malfunction(s)  /hazard(s)  occur. 

NEGLIGIBLE 

Less  than  minor  injury.  Does  not  impair  any  of  the 
critical  systems 

FIGURE  5-1.  UNDESIRED  EVENT  SEVERITY  CATEGORIES 


CATEGORY 

LEVEL 

SPECIFIC  EVENT 

A 

FREQUENT 

Not  an  unusual  event,  could  occur  several  times  in  annual 
operations 

B 

PROBABLE 

Event  could  occur  several  times  in  the  lifetime  of  the 
submersible 

C 

OCCASIONAL 

Expected  to  occur  at  least  once  in  the  lifetime  of  the 
submersible 

D 

REMOTE 

Event  is  unlikely  to  occur  during  the  lifetime  of  the 
submersible 

E 

IMPROBABLE 

Event  is  so  unlikely  that  it  is  not  expected  to  occur  in  the 
lifetime  of  the  submersible 

ASSUMPTION. 

Event  is  estimated  to  occur  as  a  function  of  number  of  dives,  operating  hours,  and 
the  number  of  patrons  carried  Sub  will  dive  an  average  of  5  times  a  day,  300  days  a 
year 


FIGURE  5-2.  UNDESIRED  EVENT  PROBABILITY  CATEGORIES 
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TABLE  5-1.  UNDESIRED  EVENT  SEVERITY  ESTIMATES 


In  operational  phases  such  as  passenger  transfer  and  pre-dive,  the  severity  or  effect 
of  certain  events  on  a  passenger  or  crewmember  may  be  less  than  when  submerged. 
This  is  because  the  passenger/crew  may  evacuate  the  emergency  situation  more 
readily  during  passenger  transfer  and  pre-dive  operations.  Hence,  in  most  instances, 
the  undesired  event  may  be  categorized  as  "Critical"  or  "Marginal." 

In  contrast  to  the  surface  operations,  the  submersible  may,  during  descent/ascent  or 
touring,  have  insufficient  time  to  surface.  Because  passengers/crew  may  thus  be 
unable  to  evacuate  emergency  conditions,  the  undesired  event  may  result  in  more 
severe  consequences.  When  this  situation  is  present,  the  severity  of  the  undesired 
event  is  deemed  to  be  a  Category  I  "Catastrophe."  Although  the  severity  or 
consequences  of  an  event  could  be  great,  the  probability  of  an  undesired  event 
occurring  could  be  quite  small.  This  is  because  both  the  emergency  condition  must 
occur  and  the  passenger/crew  cannot  evacuate  that  emergency  condition  in  time  to 
prevent  the  occurrence  of  the  casualty. 

5.1.2  Probability  of  Occurrence  of  Undesired  Event 

To  establish,  in  absolute  terms,  the  probability  that  an  event  will  occur,  requires  a 
calculation  based  on  previous  experience.  This  calculation  should  take  into 
consideration  that  the  event  may  have  occurred  or  been  reported  to  occur  a  certain 
number  of  times.  For  the  passenger  carrying  submersible,  no  publicly  available  data 
base  exists  from  which  to  calculate  the  probability  of  occurrence  of  an  undesired 
event.  Operating  experience  and  data  for  military  submarines  (especially  nuclear 
submarines)  is  classified  and  operating  experience  and  data  on  industrial/research 
submersibles  is  limited.  Data  on  incidents  and  near  misses  is  limited  for  military 
submarines  and  industrial/research  submersibles  and  cannot  be  used  to  adequately 
calculate  probabilities.  To  provide  an  indication  of  the  relative  probability  of 
occurrence  of  the  undesired  events,  the  Hazard  Probability  Matrix  of  MIL-STD-882B 
has  been  modified  as  shown  in  Figure  5-2.  The  term  "several"  is  intended  to  connote 
that  an  event  may  occur  10  times  in  a  designated  period  (annual,  lifetime,  etc.). 
Table  5-2  presents  an  estimate  of  the  probability  of  occurrence  of  the  undesired 
events.  These  estimates  are  subjective  and  as  shown  in  the  fault  trees  in  Appendix  D, 
require  that  both  the  hazard  and  the  inability  or  failure  to  control  the  undesired 
event  must  occur  be  present  for  the  undesired  event  to  result.  As  an  example,  for  a 
fire/smoke  condition  to  exist,  the  fire  must  occur  and  the  fire  is  not  controlled  or 
contained. 
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5.2  RISK  ASSESSMENT  ESTIMATES 


The  risk  associated  with  an  undesired  event  is  the  product  of  the  severity  of  the 
event  and  the  probability  of  occurrence  of  that  event.  For  the  purpose  of  this 
assessment,  the  worst  estimated  severity  value  has  been  assigned  to  the  undesired 
event.  As  shown  in  Table  5-1,  the  severities  assigned  to  the  undesired  events  were 
primarily  of  a  critical  and  catastrophic  nature.  In  contrast,  the  estimated  levels 
assigned  in  Table  5-2  indicate  that  the  probability  of  occurrence  of  such  events 
would  be  uncommon. 

Although,  in  most  cases,  the  probability  of  the  undesired  events  is  estimated  to  be 
low,  the  potential  severity  of  certain  undesired  events  listed  requires  that  some  type 
of  action  be  taken  to  minimize  the  risk.  The  risk  assessment  estimates  shown  in 
Figure  5-3  can  assist  in  the  decision-making  process  to  determine  whether  individual 
submersible  system  or  subsystem  hazards  should  be  eliminated,  controlled,  or 
accepted  to  reduce  the  occurrence  of  the  particular  undesired  event. 

To  evaluate  these  undesired  events,  the  Risk  Assessment  Matrix  shown  in  Figure  5-4 
(modified  from  MIL-STD-882B)  was  used.  The  undesired  event.  Passenger  Falls  in 
Water  (During  Transfer),  was  assigned  a  IIB  (Critical/Probable)  risk  index  value. 
Accordingly,  the  Matrix  indicates  that  this  is  inherently  "Unacceptable"  and 
therefore  action  must  be  taken  to  eliminate  or  control  the  hazards  associated  with 
this  event.  Action  should  also  be  taken  to  minimize  the  potential  risk  of  undesired 
events  with  risk  index  values  of  ID,  IIC,  IID,  HE,  and  IIIB.  Section  6  identifies  and 
presents  10  general  areas  of  countermeasures  that  may  be  employed  to  reduce  the 
potential  risk  of  the  undesired  events. 


5-7 


5-8 


UNDESIRED  EVENT  CATEGORIES 


IV 

NEG'  IGIBLE 


IVC 

IV  D 

IV  E 

RISK  INDEX 

IA.  IB.  1C.  1 1  A.  1 1 B ,  IMA 

ID.  IIC.  IID,  DIB,  MIC 

IE.  ME.  MID,  IIIE,  IVA.  IVB 
IVC,  IVD,  IVE 


UNACCEPTABLE 

UNACCEPTABLE  (  MANAGEMENT  DECISION  REQUIRED  ) 
ACCEPTABLE  WITH  REVIEW  BY  MANAGEMENT 
ACCEPTABLE  WITHOUT  REVIEW 


FIGURE  5-3.  RISK  ASSESSMENT  MATRIX 
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6.  RISK  REDUCTION  COUNTERMEASURE  IDENTIFICATION 


The  hazard  scenarios  presented  in  Appendix  A  provide  an  insight  into  how  typical 
emergency  situations  may  arise  during  the  operation  of  a  passenger  carrying 
submersible.  Each  of  the  undesired  events  identified  in  the  scenarios,  the  PHA  and 
the  fault  trees  were  assessed  for  severity  and  probability  of  occurrence  and  the 
results  are  presented  in  Section  5.  For  the  majority  of  the  undesired  events,  the 
severity  was  estimated  to  be  "Critical"  or  "Catastrophe."  The  probability  of 
occurrence,  with  the  exception  of  passenger  falling  accidents,  ("Probable"),  was 
estimated  to  be  "Occasional,"  "Remote"  or  "Improbable."  In  terms  of  the 
acceptance  criteria  presented  in  Figure  5-4,  the  severity  of  the  majority  of  the 
undesired  events  does  indicate  that  certain  actions  should  be  taken  to  minimize 
both  the  consequences  and  probability  of  occurrence. 

Actions  to  be  taken  to  minimize  the  potential  risk  are  termed  countermeasures  For 
the  purpose  of  this  study,  a  countermeasure  may  be  defined  as  any  action  or  series  of 
actions  that  may  be  taken  to  reduce  the  risk  of  a  casualty  associated  with  the 
operation  of  a  passenger  carrying  submersible.  The  risk  reduction  may  be 
accomplished  by  countermeasures  intended  to  eliminate  the  occurrence  or  minimize 
the  effect  of  the  undesired  event.  Elimination  or  prevention  of  the  occurrence  of 
the  undesired  event  is  obviously  preferable  but  not  always  possible.  Recognizing 
this,  it  is  important  to  minimize  the  severity  or  effects  of  the  specific  undesired 
event.  This  may  be  accomplished  by  reducing  the  expected  severity  of  the  event 
and/or  enhancing  the  response  to  the  occurrence  of  the  event.  The  majority  of  risk 
reduction  countermeasures  described  below  emphasize  the  prevention  of  the 
occurrence  of  the  event  (primary  countermeasure)  with  the  response  or  secondary 
countermeasures  comprising  the  remainder  of  the  countermeasures. 

During  the  conduct  of  the  PHA,  recommendations  for  countermeasures  were 
identified  for  the  hazards  and  causal  factors  identified  in  each  element  of  the 
submersible  system  and  subsystem. 

The  recommendations  for  corrective  actions  presented  in  the  PHA  worksheets 
describe  the  method  selected  to  eliminate  the  causes  or  minimize  the  effects  of  each 
hazard.  One  or  more  recommendations  are  provided  for  each  hazard-cause 
identified  within  the  individual  submersible  systems  and  subsystems.  Many 


6-1 


recommendations  are  based  on  existing  codes,  standards,  and  guidelines.  However, 
a  number  of  recommendations  are  either  based  on  information  which  may  need 
updating  or  are  not  currently  addressed  at  all  by  existing  references.  At  times, 
reference  sources  recommend  different  criteria  (i.e.,  percent  of  CO2  permitted);  in 
such  cases,  all  criteria  are  presented. 

The  following  sections  present  a  summary  of  the  countermeasures  identified  in  the 
PHA.  For  the  detailed  identification  of  individual  system  and  subsystem 
countermeasures  that  may  be  employed  to  mitigate  the  undesired  event,  the  reader 
is  referred  to  the  PHA  in  Appendix  C. 

6.1  DESIGN  COUNTERMEASURES 

During  the  conduct  of  the  Preliminary  Hazard  Analysis  (PHA),  it  was  found  that  most 
hazards  resulting  from  design  or  fabrication  of  submersibles  can  be  avoided  by 
following  existing  codes,  standards,  regulations,  and  guidelines.  However,  it  should 
be  noted  that  the  existing  codes  and  standards  were: 

o  Developed  for  application  to  surface  vessels  (46  CFR  and  33  CFR),  and/or 

o  Developed  for  application  to  submersibles  used  by  industry,  scientific 

research  and  the  military  (ABS,  PVHO  and  NAVMAT  P9290). 

The  ABS  RulesS  and  the  ASME  /PVHO  Safety  Standard^  contain  design  requirements 
that  are  applicable  for  most  of  the  submersible  subsystems  and  equipment. 

In  addition,  the  current  Coast  Guard  submersible  guidelines,  plan  review  and 
inspection  process,  and  CFR  regulations  also  address  many  of  the  subsystem  and 
equipment  hazards  from  a  design  standpoint  The  Coast  Guard  is  also  preparing  a 
Navigation  and  Vessel  Inspection  Circular  which  will  provide  guidance  for  certifying 
passenger  carrying  submersibles  used  in  the  tourist  trade. 

Redundant  or  backup  systems  for  safety  critical  items  are  recommended  in  several 
instances  in  the  PHA.  Although  backup  systems  are  expensive  and  often  complex,  it 
is  believed  that  such  systems  are  likely  to  be  the  best  way  to  reduce  the  probability  of 
certain  undesired  events.  It  may,  however,  be  determined  during  design  that  other 
methods  of  controlling  hazards  may  be  more  appropriate.  Also,  it  may  be 
determined  during  design  that  backup  systems  are  required  to  reduce  the 


probability  of  additional  hazards.  The  decision  regarding  which  systems  require 
back-up  has  been  based  on  the  information  available  at  the  time  the  analysis  was 
completed. 

Fire  safety  of  materials  for  the  confined  interior  spaces  cf  the  submersible  was 
identified  as  a  major  hazard  of  concern.  The  existing  references  do  not  consider  the 
negative  effects  of  the  flame  spread  and  smoke  emission  characteristics  of  interior 
materials.  The  Federal  Aviation  Administration1*),  Urban  Mass  Transportation 
Administration11,  and  the  Federal  Railroad  Administration12,  have  developed 
regulations  and  guidelines  for  passenger  interior  materials  for  airplanes,  transit  cars 
and  intercity  rail  cars.  The  criteria  in  these  regulations  and  guidelines  could  also  be 
applied  to  passenger  carrying  submersibles  to  improve  fire  safety. 

The  additional  submersible  safety  issues  identified  below  should  be  explored  by  the 
Coast  Guard  in  further  detail.  (In  some  cases,  certain  items  such  as  the  hatch  seal 
design  are  covered  by  only  the  NAVMAT  P-9290. !3  ). 

o  Hatch  seal  design  to  prevent  leakage, 

o  Penetration  design  to  include  separate  safety(sea)  valves  and  cutoffs  to 
prevent  or  control  leakage, 

o  Viewport  protection  to  prevent  internal  or  external  damage, 

o  Propulsion  and  maneuvering  capability  to  ensure  maneuverability, 
under  all  conditions  (such  as  entanglement), 

o  Immediate  automatic  activation  of  emergency  lighting  upon  electrical 
power  loss, 

o  Battery  protection  against  explosion, 

o  Redundant  communication  ability,  both  while  submerged  and  on  the 
surface,  and 

o  Provision  of  alarms  to  indicate  air  pressure  loss,  water  or  hydraulic  fluid 
leakage,  fire/smoke,  air  quality  (oxygen  supply,  CO2  level), 

Other  serious  safety  issues  identified  during  the  PHA,  which  do  not  appear  to  be 
adequately  covered  by  existing  codes,  standards,  or  regulations,  are  associated  with 
training,  operations,  maintenance,  and  documentation.  As  indicated  in  the  PHA, 
hazards  in  these  areas  are  characterized  by  a  high  incidence  of  human  interaction. 
The  following  sections  of  general  countermeasures  are  the  result  of  a 
comprehensive  review  of  the  PHA  by  a  series  of  knowledgeable  individuals.  These 
countermeasures  reflect  what  those  individuals  believe  are  the  most  serious  safety 
related  issues  which  should  be  addressed. 
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6.2  TESTING  AND  INSPECTION  COUNTERMEASURES 


A  testing  and  acceptance  program  should  be  implemented  to  determine  if  all  safety- 
related  systems  aboard  the  submersible  meet  operational  requirements.  All  test 
procedures  and  results  of  the  tests  should  be  documented  and  provided  to  the  USCG. 
These  tests  should  include  the  following : 

o  Subsystem  Test  ( i.e.,  life  support,  electrical,  etc.), 
o  System  Test  ( i.e.,  hull,  etc.), 

o  Operational  Tests, 

o  Acceptance  Tests,  and 

o  Periodic  Emergency  System  Tests. 

Each  submersible  should  be  certified  by  the  Coast  Guard,  prior  to  initiating 
operations  with  passengers.  Builders  trials  should  demonstrate  that  the  operating 
characteristics  of  the  submersible  safety  systems  and  subsystems  match  the 
parameters  specified  in  the  design.  Sea  trials  should  be  conducted  only  after  all 
discrepancies  identified  during  the  early  testing  phases  have  been  resolved  to  the 
satisfaction  of  the  USCG.  Certification  dives  should  be  conducted  in  the 
environment  where  the  submersible  will  operate. 

Periodic  inspections  by  the  submersible  operators  and  guidelines  Tor  these 
inspections  should  be  prepared.  Inspections  should  be  conducted  during  the 
following  phases:  Manufacture,  Testing,  and  Operation.  Reports  should  be 
prepared  and  submitted  to  the  USCG  for  approval. 

6.3  CONFIGURATION  MANAGEMENT  COUNTERMEASURES 

A  configuration  management  program  should  be  implemented  to  ensure  that 
design,  development,  and  operational  changes  to  safety-related  systems  and 
subsystems  for  the  submersible  are  subjected  to  strict  configuration  control.  These 
documents,  should  as  a  minimum,  include  Training  Materials.  Test  Documentation, 
System  Maintenance  Documents,  Operating  Procedures,  and  Emergency  Procedures. 
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6.4  OPERATIONAL  COUNTERMEASURES 


There  are  no  guidelines  or  regulations  which  require  the  submersible  manufacturers 
to  define  the  operational  parameters  for  specific  submersibles.  Design,  fabrication, 
testing,  acceptance,  and  operations  of  safety-related  systems  and  subsystems  could 
vary  considerably  depending  on  the  submersible's  intended  mission.  Different 
potential  missions  mentioned  in  the  available  literature  include  passenger  ferry 
operations,  deep  submergence  dives,  shallow  dives  in  shallow  water  (less  than  200 
feet  deep),  and  shallow  dives  in  deep  water  (water  depth  up  to  several  thousand 
feet  deep).  The  intended  operating  parameters  of  each  submersible  are  currently 
approved  by  the  USCG.  Countermeasures  should  be  established  which  address  the 
following : 

o  Guidelines  and  regulations  requiring  development  and  documentation 
for  operating  procedures, 

o  Guidelines  for  passenger  indoctrination,  and 

n  Guidelines  for  the  following  operations: 

Deep  submergence, 

Shallow  dives  in  deep  water, 

Operations  in  colder  climates  or  cold  water. 

6.5  TRAINING  COUNTERMEASURES 

Training  programs  should  be  developed  for  all  safety-related  phases  of  the  tourist 
submersible  operation.  Guidelines,  which  include  minimum  qualifications  for 
applicants  in  critical  positions,  should  be  established.  A  training  path  leading  to 
certification  should  be  clearly  defined,  as  well  as  measurable  goals  and  objectives  for 
each  aspect  of  the  training.  The  training  guidelines  prepared  by  the  Deep 
Submersible  Pilots  Association’4  could  be  adapted  for  passenger  submersible 
personnel. 

The  training  program  should  clearly  represent  a  systems  approach  to  training  and 
include,  but  not  be  limited  to: 

o  A  training  assessment  phase  to  determine  the  training  needs  and  to 
derive  training  objectives, 

o  A  training  development  phase  to  select  training  methods  and  to 
develop  the  training  courses, 
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o 


A  training  phase  during  which  training  is  conducted,  and 

o  An  evaluation  and  feedback  phase  which  should  continue  throughout 
the  submersible  system  life  cycle.  This  feedback  can  assist  in 
determining  if  the  training  is  appropriate  for  the  tasks  being 
performed,  and  to  assure  that  any  operational  or  equipment  changes 
are  reflected  in  the  curricula. 


6.6  MAINTENANCE  COUNTERMEASURES 

Maintenance  countermeasures  include  the  development  of  maintenance  procedures 
and  management  documentation  for  all  safety-related  systems  and  subsystems.  This 
includes  routine  maintenance  procedures  and  preventive  maintenance  procedures 
and  plans.  These  should  be  developed  during  the  design  and  development  phase 
and  approved  by  the  USCG.  In  addition,  audits  or  periodic  inspections  should  be 
conducted  to  assure  that  approved  procedures  are  being  implemented  and 
preventative  maintenance  is  being  performed. 

Maintenance  documentation  should  include  requirements  for  failure  analysis, 
quality  assurance  standards  for  critical  repairs,  guidelines  for  parts  substitution, 
guidelines  for  ready  spares  stock,  inspection  and  testing  requirements,  and 
preventative  maintenance  record  requirements.  Navy  documentation  which  may  be 
applicable  includes  all  4790  maintenance  series  instructions15,i6,i7(  and  the  MIL-P- 
24534A,  military  specification  for  maintenance1®. 

Operations  conducted  in  areas  remote  from  the  submersible  system  or  subsystem 
manufacturers  can  create  numerous  logistics-related  problems,  many  of  which  may 
result  in  safety  problems,  including  the  following: 

o  Inability  to  obtain  s;/are  parts  quickly  resulting  in  substitution  of 
unapproved  parts, 

o  Spare  parts  which  have  been  stored  and  have  exceeded  their  shelf  life, 

o  Deterioration  of  parts  due  to  harsh  environments  (high  humidity,  salt 
air,  excessive  temperatures),  and 

o  Inadequate  or  improper  repair  and  re-use  of  components. 

Quality  Assurance  (QA)  plans  should  include  procedures  for  acceptance  of  spares  and 
spare  substitution  guidelines.  All  critical  repairs  should  be  performed  in  accordance 
with  strict  QA  procedures.  A  logistic  support  plan  should  include  requirements  for 
failure  analysis  to  be  used  as  an  input  to  determine  spares  stocks. 
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6.7  EMERGENCY  PREPAREDNESS  COUNTERMEASURES 


An  emergency  preparedness  plan  should  be  developed  to  address  all  aspects  of 
emergency  planning  and  emergency  response.  This  document  should,  as  a  minimum, 
include:  emergency  operating  procedures,  procedures  for  search  and  rescue, 
operating  emergency  equipment,  operating  in  inclement  weather,  and  coordination 
with  other  organizations. 

6.8  LIFE  EXPECTANCY  COUNTERMEASURES 

A  vessel  life  expectancy  or  safe  number  of  operating  cycles  for  each  submersible  hull 
type  should  be  determined  during  the  design  phase.  This  "safe  number  of  cycles" 
should  be  reviewed  periodically  during  the  operation  of  each  submersible  to 
determine  if  the  predicted  life  expectancy  is  appropriate  considering  actual 
experience.  Issues  to  be  considered  include  but  are  not  limited  to: 

o  Viewport  and  hatch  seals, 
o  Hull  fatigue, 

o  Excessive  corrosion, 

o  Lack  of  maintenance, 

o  Hull  damage  (should  require  immediate  recertification),  and 

o  Repairs  to  hull  penetration  (should  require  acceptance  tests). 

6.9  RECERTIFICATION  OR  INSPECTION  COUNTERMEASURES 

As  previously  indicated,  all  submersible  safety  related  systems  and  subsystems  should 
be  periodically  inspected  by  the  USCG.  Criteria  should  be  developed  for  determining 
when  (other  than  after  a  normal  periodic  inspection)  a  submersible  should  be 
inspected,  or  if  necessary,  recertified.  Several  incidents  which  should  require  re¬ 
certification  are  listed  in  the  previous  sub-section.  Other  incidents  which  should 
require  recertification,  or  as  a  minimum,  inspection  by  the  USCG  include,  but  are  not 
limited  to: 

o  Excursion  beyond  test  depth  (should  require  immediate  re¬ 
certification), 

o  A  major  change  in  operating  parameters, 
o  After  a  submersible  is  drydocked, 

o  System  modifications  (engineering  changes), 
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o  Major  system  replacements, 
o  After  scheduled  overhauls,  and 
o  After  transfer  of  ownership. 

6.10  DEGRADED  OPERATION  COUNTERMEASURES 

As  with  aircraft,  ships,  or  other  transportation  systems,  submersibles  can  operate  in  a 
degraded  mode.  Minor  malfunctions  such  as  burned-out  light  bulbs  and  faulty 
indications  may  not  jeopardize  the  safety  of  the  passengers  or  crew.  However, 
criteria  should  be  developed  to  clearly  indicate  which  failures  or  combinations  of 
failures  constitute  a  minor  inconvenience,  and  which  failures  should  result  in 
canceling  the  dive. 
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7.  EVALUATION  OF  POTENTIAL  COUNTERMEASURES 


A  total  of  10  broad  areas  of  countermeasures  were  identified  and  briefly  described 
in  Section  6.  Within  each  of  these  areas,  the  PHA  identifies  specific  countermeasures 
that  may  be  applied  to  the  individual  submersible  subsystems.  In  several  instances 
within  the  PHA,  more  than  one  countermeasure  is  identified  for  a  particular 
subsystem.  Furthermore,  the  individual  undesired  event  may  have  resulted  from:  1) 
hazards  and  causal  effects  contained  in  one  or  more  subsystems  in  the  same  system 
(within  the  hull  system,  flooding  may  occur  from  several  subsystems);  or  2)  from 
hazards  and  causal  effects  in  different  systems  (i.e.,  flooding  may  also  occur  in  the 
operating  procedures  subsystem). 

Recognizing  that  an  undesired  event  may  result  from  one  or  more  sets  of  hazards 
and  causes  in  either  one  system  or  involving  different  systems  and  subsystems,  two 
or  more  countermeasures  may  be  required  to  prevent  or  reduce  the  occurrence  of 
that  undesired  event.  With  this  knowledge,  it  is  important  that  each  undesired 
event  be  examined  and  all  possible  system  and  subsystem  hazards  and  causal  effects 
be  examined  to  identify  countermeasures  that  will  mitigate  the  undesired  event. 
Having  identified  all  of  the  countermeasures  that  may  be  employed  to  mitigate  an 
undesired  event,  selection  of  the  most  appropriate  countermeasure  will  be 
determined  by  examining  the  following  factors: 

o  Effectiveness  of  Countermeasure 

-  Reduce  probability  of  occurrence 

-  Reduce  severity  of  event 

o  Cost  of  Implementation 

-  Design  to  eliminate 

-  Operation  procedures  to  control 

-  Retrofit 

o  Enforcement  Requirements 

These  three  factors  are  the  primary  considerations  to  be  evaluated  in  selecting  the 
appropriate  countermeasure  to  mitigate  an  undesired  event. 

The  means  by  which  the  results  of  this  system  safety  analysis  may  be  incorporated  in 
submersible  design  and  operation  is  through  standards  published  in  the  Code  of 


Federal  Regulations.  (CFR)  Development  and  implementation  of  safety  standards 
will  require  a  “Regulatory  Assessment"  to  examine  the  effect  the  regulations  will 
have  on  the  submersible  industry.  This  "Regulatory  Assessment"  will  establish  the 
costs  and  benefits  associated  with  the  particular  selected  standards/regulations.  A 
detailed  assessment  is  not  possible  until  the  standards  or  regulations  have  been 
drafted.  The  following  sections  provide  guidance  on  how  the  individual  factors  may 
be  evaluated  and  assessed. 

7.1  EFFECTIVENESS  OF  COUNTERMEASURES 

Evaluation  of  the  effectiveness  of  a  countermeasure  requires  a  judgment  on  how  the 
implementation  of  a  specific  countermeasure  will  influence  the  probability  of 
occurrence  and  severity  of  the  undesired  event  being  addressed.  With  regard  to 
probability  of  occurrence,  the  countermeasure  may: 

o  Result  in  no  change, 

o  Reduce  the  probability  of  occurrence  of  the  event,  or 
o  Totally  eliminate  the  possibility  of  event  occurrence  (no  event). 

In  a  similar  manner,  the  countermeasure  may  influence  event  severity  by: 

o  No  change, 

o  Slightly  less  severe, 

o  Totally  minimize  the  effect,  or 

o  Possibly  increase  severity. 

7.2  COST  OF  IMPLEMENTATION 

The  cost  incurred  in  implementing  a  countermeasure  will  depend  on  when  in  the 
submersible  life  cycle  the  countermeasure  is  adopted.  In  general,  it  is  more  cost- 
effective  to  design  in  the  countermeasure  prior  to  production  or  operation  of  the 
system.  Furthermore,  the  cost  will  be  directly  related  to  the  submersible  system  or 
subsystem  into  which  the  countermeasure  is  adopted.  For  example,  procedural 
changes  will  generally  cost  less  to  implement  than  providing  new  or  modified 
submersible  equipment.  The  cost  associated  with  the  10  areas  of  countermeasures 
identified  in  Section  6  may  be  allocated  into  the  following  phases  of  the  system  life 
cycle: 
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o  System  design, 

o  System  fabrication, 

o  System  testing, 

o  System  operation, 

o  System  maintenance,  and 

o  System  retrofit. 

Within  each  of  the  above  phases  of  the  system  life  cycle,  the  cost  will  depend  on  the 

following  basic  cost  elements: 

o  Materials  costs, 
o  Labor  costs, 
o  Training  costs, 
o  Operating  costs,  and 

o  Downtime  costs. 

Having  established  the  cost  of  implementation  of  a  specific  countermeasure,  the  cost 
must  be  considered  relative  to  the  effectiveness  of  the  countermeasure.  For 
example,  the  cost  associated  with  a  design  change  early  in  the  system  design  may  be 
worth  the  additional  cost  if  that  countermeasure  will  eliminate  a  hazard. 

Labor  and  materials  costs  expended  in  the  design  and  system  testing  phases  should 
be  employed  to  eliminate  hazards  in  the  system.  Labor,  training,  and  downtime 
costs  associated  with  the  implementation  of  a  countermeasure  during  system 
operation  and  maintenance  are  more  likely  directed  at  controlling  known  hazards. 
This  approach  is  not  as  desirable  or  as  safe  as  eliminating  the  hazard  prior  to  system 
operation. 

7.3  ENFORCEMENT  REQUIREMENTS 

A  secondary  cost  associated  with  the  implementation  of  a  countermeasure  is  that  of 
ensuring  that  the  countermeasure  has  actually  been  implemented  and  is  operating 
properly.  For  example,  special  operating  procedures,  warning  devices,  etc.  This 
requirement  for  enforcement  will  require  the  dedication  and  the  expenditure  of 
Coast  Guard  resources.  Enforcement  is  an  expense  that  must  be  borne  by  the 
Government  and  as  such  will  not  be  discussed  in  detail.  However,  this  should  be 
evaluated  prior  to  countermeasure  selection  and  implementation. 
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8.  CONCLUSIONS  AND  RECOMMENDATIONS 


After  reviewing  the  results  of  the  system  safety  analysis  of  passenger  carrying 

submersibles,  the  following  conclusions  and  recommendations  are  provided  for 

consideration. 

8.1  CONCLUSIONS 

1.  The  use  of  submersibles  to  carry  passengers  on  underwater  tours  has 
increased  in  popularity  over  the  past  5  years  and  continued  commercial 
growth  is  anticipated. 

2.  The  Coast  Guard  has  used  the  contents  of  46  CFR,  Subchapter  T  Small 
Passenger  Vessels,  and  other  applicable  parts  of  46  CFR  and  33  CFR,  to 
formulate  guidelines  used  to  certify  passenger  carrying  submersibles  subject 
to  U  S.  jurisdiction.  However,  many  of  the  requirements  contained  in  the 
existing  Coast  Guard  statutes  and  regulations  cannot  be  applied  to  or  are 
inappropriate  for  submersibles  because  they  have  been  developed  for  surface 
craft. 

3.  No  loss  of  life  has  occurred  to  date  for  any  of  the  tourist  submersible 
operations. 

4.  Data  is  not  readily  available  which  either  describes  or  quantifies  actual 
accidents/incidents  or  specific  hazards  involving  passenger  carrying 
submersibles  currently  used  in  the  tourist  trade. 

5.  More  than  140  potential  hazards  and  500  causes  were  identified  during  the 
system  safety  analysis  performed  for  this  study.  Unless  these  hazards  are 
eliminated  or  controlled,  they  could  result  in  undesired  events  which  could 
lead  to  submersible  passenger/crew  casualties. 

6.  While  the  prevention  of  as  many  undesired  events  and  hazards  as  is  practical  is 
desirable  from  a  safety  standpoint,  certain  hazards  are  either  inherent  to  the 
operation  of  the  system  or  cannot  be  completely  eliminated.  The  fault  tree 
diagrams  demonstrate  the  importance  of  the  interaction  of  undesired  events 
ana  their  causes.  Moreover,  the  consequences  of  an  undesired  event  or 
hazard  could  be  more  severe  if  it  is  not  controlled  or  responded  to  in  some 
way. 

7.  Undesired  events  which  could  lead  to  a  passenger  casualty  include: 
flooding/leakage,  collision,  fire/explosion,  air  contamination,  passenger 
illness/injury,  passenger  falls  in  water,  passenger  falls  on  deck,  submersible  is 
unable  to  surface,  submersible  is  not  rescued,  excessive  pitch  or  roll,  and 
submersible  isolation.  The  location  of  the  submersible  when  the  undesired 
event  occurs  has  a  direct  impact  on  the  severity  of  the  event  and  the  level  of 
emergency  response  required. 
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8.  An  assessment  of  the  undesired  events  identified  passenger  falls  during 
transfer  between  the  taxi  vessel  and  the  submersible  as  a  major  safety 
problem  in  terms  of  severity  (II  Critical)  and  probability  of  occurrence  (B 
Probable).  Although  "Unacceptable"  as  defined  by  the  criteria  of  the 
Military  Standard :System  Safety  Program  Requirements  (MIL-STD  882B)4,  this 
undesired  event  cannot  be  totally  eliminated  due  to  the  inherent  hazard  of 
possible  changes  in  the  sea  state.  Other  undesired  events  were  assigned  risk 
values  of  ID,  IIC,  II D,  HE,  and  1118  (See  Table  5-3).  These  undesired  events 
require  further  analysis  to  reduce  the  level  of  risk. 

9.  A  number  of  industry  and  Navy  codes,  standards  and  guidelines  exist  which 
address  the  majority  of  submersible  design  safety  issues.  However,  these 
codes,  standards,  and  guidelines  were  developed  for  application  to 
submersibles  used  by  industry,  scientific  research,  and  the  military.  Moreover, 
these  submersibles  carry  a  limited  number  of  personnel,  the  majority  of  whom 
are  knowledgeable  and  experienced  with  submersible  operations. 

10  Certain  safety  issues  pertaining  to  the  unique  characteristics  of  submersibles 
carrying  large  numbers  of  tourists  (more  than  6)  have  been  identified  as  a 
result  of  the  system  safety  analysis.  These  issues  include  design,  training, 
operations,  maintenance,  testing  and  inspection,  configuration  management, 
emergency  preparedness,  life  expectancy,  reinspection/recertification,  and 
degraded  operations.  Countermeasures  which  address  these  safety  issues  are 
contained  in  Section  6. 

1 1 .  Selection  of  the  most  appropriate  countermeasure  to  reduce  the  severity  and 
probability  of  an  undesired  event  is  dependent  on  three  factors, 
effectiveness,  cost  of  implementation  and  enforcement  requirements. 

12.  A  Quality  Assurance  and  Inspection  program  is  essential  to  ensure  that 
materials,  fabrication,  maintenance  and  operations  do  not  degrade  the  safety 
of  the  submersible. 


8.2  RECOMMENDATIONS 


1 .  The  Coast  Guard  should  require  additional  analysis  to  be  performed  to  further 
investigate  the  undesired  events  assigned  the  risk  values  of  II  B,  ID,  IIC,  II D,  HE, 
and  IliB  (See  Table  5-3),  in  order  to  identify  the  appropriate  means  of 
controlling  the  severity  and  minimizing  the  probability  of  occurrence  through 
design,  safety  devices,  warning  devices,  special  procedures,  and  training,  or  a 
combination  thereof 

2.  The  Coast  Guard  should  further  explore  the  following  design  safety  issues 
specifically  for  application  to  passenger  carrying  submersibles: 

o  Redundancy  of  safety  critical  systems, 

o  Fire  and  smoke  characteristics  of  interior  materials  such  as  seating,  etc., 
o  Hatch  seal  design  to  prevent  leakage, 
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o  Penetration  design  to  include  separate  safety  (sea)  valves  and  cutoffs  to 
prevent  or  control  leakage, 

o  Viewport  protection  to  prevent  internal  or  external  damage, 

o  Propulsion  and  maneuvering  capability  to  ensure  maneuverability  under 
all  hazardous  conditions  (sucn  as  entanglement), 

o  Immediate  activation  of  emergency  lighting  upon  electrical  power  loss, 

o  Battery  protection  against  explosion, 

o  Redundant  communication  ability,  both  while  submerged  and  on  the 
surface,  and 

o  Provision  of  alarms  to  indicate  air  pressure  loss,  water  or  hydraulic  fluid 
leakage,  fire/smoke,  air  quality  (Oxygen  supply,  CO2  level). 

3.  The  Coast  Guard  should  require  that  each  passenger  carrying  submersible 
designer/operator  develop  a  System  Safety  F  im.  This  program  should 
include  a  system  safety  plan  and  the  review  pro.  >  necessary  to  identify  and 
resolve  all  single  point  hazards  in  safety  critical  systems  and  subsystems.  This 
system  safety  plan  should  designate  the  individual  responsible  for  the  safety 
of  the  submersible  and  address  means  of  hazard  reduction  such  as  training, 
operations,  maintenance,  testing  and  inspection,  configuration  management, 
emergency  preparedness,  life  expectancy,  reimpection/recertification  and 
degraded  operations,  to  address  specific  hazards  as  identified. 

4.  The  Coast  Guard  should  develop  and  implement  requirements  which  will 
serve  to  prevent  the  occurrence  of  undesired  events  or  minimize  their 
consequences  and/or  reduce  the  probability  of  occurrence.  These 
requirements  should  address  the  general  areas  of  training,  operations, 
maintenance,  testing  and  inspection,  configuration  management,  emergency 
preparedness,  life  expectancy,  reinspection/recertification  and  degraded 
operations,  as  identified  in  Section  6  of  this  report. 

5.  The  Coast  Guard  should  develop  criteria  for  and  implement  an 
accident/incident  reporting  system  to  identify  safety  issues  and  quantify 
accident  trends. 

6.  The  Coast  Guard  should  review  and  expand,  if  necessary,  the  document 
entitled,  "Passenger  Carrying  Submersible  Inspection  Book. "  This  document 
should  then  be  distributed  to  all  appropriate  OCMI  to  provide  assistance  to 
Coast  Guard  personnel  in  evaluating  and  certifying  local  submersible 
operations. 
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APPENDIX  A.  HAZARD  SCENARIOS 


This  Appendix  describes  scenarios  in  which  passenger  carrying  submersibles  could  be 
involved  in  emergency  situations. 

SCENARIO  DEVELOPMENT 

The  use  of  previous  operating  experience  or  case  studies  of  past  accidents  or 
incidents  provides  a  starting  point  for  identification  of  the  types  of  emergency 
situations  or  "events,"  which  have  occurred.  From  this  data,  scenarios  which  reflect 
the  real-world  accident  experience  may  then  be  created.  The  scenarios  contained  in 
this  section  present  the  undesired  event,  causes,  and  ultimate  results  in  brief 
narrative  form.  Passenger  carrying  submersibles  (for  the  tourist  trade  )  have  been 
operating  in  the  Caribbean  for  the  last  5  years.  Because  this  operating  experience 
(exposure)  of  passenger  carrying  submersibles  has  not  resulted  in  the  occurrence  of 
any  deaths  or  serious  injuries,  it  is  necessary  to  review  information  from  other 
sources  to  determine  the  kinds  of  potential  emergency  situations  which  could  occur. 
The  scenarios  presented  here  have  been  derived  from  the  experiences  of  military 
submarines  and  research/industrial  submersibles.  Although  many  details  of  the 
military  experience  are  classified.  Reference  1  provides  an  excellent  insight  into 
peacetime  submarine  accidents.  Insight  into  emergency  situations  involving 
industrial/research  submersibles  is  provided  in  References  2  and  3.  Coast  Guard 
correspondence  with  submersible  companies  also  highlighted  potential  scenarios 
(see  Reference  4).  (References  for  this  appendix  are  listed  on  page  A-8.) 

Seven  typical  types  of  submersible  emergency  situations  presented  are  categorized 
as  follows: 

o  Flooding, 

o  Inability  to  ascend  or  descend, 
o  Fire, 
o  Collision, 
o  Air  contamination, 
o  Passenger  illness/injury,  and 
o  Sub  isolation  from  surface  support  vessel 
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Each  of  these  types  of  emergency  situations  can  result  from  any  number  of  causes 
and  involve  a  variety  of  hazards  or  conditions. 


FLOODING 

Scenario  1 : 

Event:  An  unexpected  wave  washes  overthe  decks  of  the  submersible  while  a 

hatch  is  open. 

Cause:  Operating  in  high  sea  state  (above  3)  or  a  large  wave  is  created  by  a 

passing  ship. 

Result:  Water  enters  submersible  causing  it  to  sink  if  corrective  action  is  not 

taken. 


Scenario  2: 

Event.  Hatch  cover  or  other  hull  penetration  is  left  open  during  dive. 

Cause:  Equipment  malfunction  (hatch  cover  failure,  etc.)  or  human  error. 

Result:  Water  enters  submersible  causing  it  to  sink  unless  hatch  cover  or  other 

hull  penetration  is  not  closed. 


Scenario  3: 

Event:  Hatch  cover,  viewport,  or  other  penetration  fails  or  malfunctions. 

Cause:  Worn  gasket,  crack  in  viewport,  fatigue,  improper  seating  of  hatch 

cover,  seal,  etc.,  impact,  electrical  overload  causing  burntnrough  of 
seal. 

Result:  Water  enters  submersible  causing  it  to  sink  if  leakage  is  not  controlled. 


Scenario  4: 

Event:  Hull  crack  or  failure  occurs. 

Cause:  Collision,  faulty  weld,  design  fault,  incorrect  material,  fabrication  error, 

exceeding  of  rated  depth,  excessive  corrosion,  fatigue  (excessive 
number  of  pressure  cycles),  or  failure. 

Result:  Water  enters  submersible  causing  it  to  sink  if  leakage  is  not  controlled. 

Hull  crack  leakage  could  possibly  be  controlled.  Hull  failure  would  most 
probably  result  in  loss  of  the  submersible. 
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Scenario  5: 

Event:  Submersible  hits  abandoned  explosive. 

Cause:  Operating  in  area  and  unaware  of  presence  of  abandoned  explosive. 

Result:  Explosion  causes  damage  to  hulland  flooding. 

SUBMERSIBLE  IS  UNABLE  TO  ASCEND  OR  DESCEND 
Unable  to  ascend 

Scenario  1 : 

Event:  Submersible  exceeds  operating  depth  and  is  unable  to  ascend. 

Cause:  Increase  in  current  speed,  lack  of  knowledge  concerning  area  depth, 

depth  gauge  failure,  sliding  down  slope,  sudden  increase  in  depth, 
change  in  salinity  of  water,  loss  of  air  (for  buoyancy). 

Result:  Submersible  /stems  fail  due  to  overpressure  -  submersible  is  unable  to 

ascend  resulting  in  air  contamination  after  life  support  system 
consumables  are  exhausted.  Hyperthermia  or  hypothermia 
(depending  on  water  temperature),  as  a  function  of  time. 

Scenario  2: 

Event:  Submersible  loses  capability  to  surface. 

Cause:  Loss  of  air  ballast,  change  in  salinity  of  water,  change  in  water 

temperature. 

i 

Result:  Air  contamination,  hyperthermia  or  hypothermia  occurs,  as  a  function 

of  time. 

Scenario  3: 

Event:  Submersible  settles  on  and  becomes  stuck  on  sea  bed  bottom,  cannot 

extricate  itself,  and  is  unable  to  ascend. 

Cause:  Loss  of  power/buoyancy,  lack  of  knowledge  of  sea  bed  bottom. 

Result:  Air  contamination  occurs;  hyperthermia  or  hypothermia  occurs, 

(depending  on  water  temp)  as  a  function  of  time. 
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Scenario  4: 


Event:  Falling  of  rock,  mud  slide  onto  vessel  (damage  or  weight)  prevents 

vessel  from  ascending. 

Cause:  Vibration  from  submersible  or  other  vessel,  submersible  touches  (hits) 

canyon  wall  causing  an  undersea  avalanche. 

Result:  Air  contamination  occurs;  hyperthermia  or  hypothermia  occurs 

(depending  on  water  temp.)  both  as  a  function  of  time. 

Scenario  5: 

Event:  The  submersible  becomes  entangled  within  rigging  or  cable  of  a  wreck, 

other  cable  or  within  kelp  and  cannot  ascend. 

Cause:  Vessel  operates  too  close  to  the  wreck,  rigging, cable,  etc. 

Result:  Air  contamination  occurs,  hyperthermia  or  hypothermia  occurs 

(depending  on  water  temp.)  both  as  a  function  of  time. 

Scenario  6: 

Event:  The  submersible  has  a  remote  video  camera  which  can  be  extended 

away  from  the  vessel  on  a  "tether."  This  tether  becomes  entangled 
around  a  rocky  /  coral  outcropping  and  the  vehicle  is  unable  to  ascend. 

Cause:  The  tether  is  of  long  length  and  is  not  easily  maneuverable. 

Result:  Air  contamination,  hypothermia  or  hyperthermia  occurs  (depending  on 

water  temp.)as  a  function  of  time. 

Unable  to  Descend 

Scenario  : 

Event:  Inability  to  change  positive  buoyancy  to  negative. 

Cause:  Lack  of  power,  control  malfunction,  air  vents  stuck  in  closed  position. 

Result:  Collision  with  surface  vessel,  excessive  pitch/roll  ,or  damage  by  high 

seas. 

FIRE 

Scenario  1 : 

Event:  Battery  explosion  occurs. 

Cause:  Buildup  of  hydrogen  gas  and  spark. 

Result:  Explosion/burnmg  gas  results  in  fire,  burns,  and  /or  air  contamination. 
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Scenario  2: 

Event:  Electrical  fire  occurs. 

Cause:  Short  circuit,  faulty  wiring,  overloaded  circuit,  etc. 

Result:  Fire,  loss  of  power,  air  contamination. 

Scenario  3: 

Event:  Passenger  strikes  lighter  or  match  for  cigarette, 

Cause:  Lack  of  knowledge  by  passenger  about  "no  smoking." 

Result:  Air  contamination. 

Scenario  4: 

Event:  Ignition  of  seats,  floor  occurs. 

Cause:  Passenger  inadvertently  ignites  seats,  bulkhead,  overhead  ceiling  or 

deck. 

Result:  Submersible  fire,  air  contamination,  heat  buildup,  damage  to 

equipment. 

COLLISION 

Scenario  1 : 

Event:  Submersible  collides  with  surface  ship  (support  or  other)  while 

ascending. 

Cause:  Surface  ship  is  unaware  of  submarine  presence  (lack  of  communication, 

failure  to  follow  proper  procedures,  poor  visibility,  support  ship  is  not 
on  scene,  failure  of  submersible  steering,  etc.). 

Result:  Damage  to  one  or  both  vessels,  flooding  (see  also  Flooding),  injury  from 

impact,  sinking,  inability  to  surface). 

Scenario  2: 

Event:  Submersible  collides  with  another  submersible  while  underwater. 

Cause:  Poor  visibility,  speed,  current  drift,  loss  of  steering  control,  human 

error. 

Result:  Damage  to  vessel,  flooding,  injury  from  impact,  sinking,  inability  to 

surface. 


Scenario  3: 

Event:  Submersible  collides  with  rocky  or  coral  outcropping,  or  is  attacked  by 

large  fish. 

Cause:  Poor  visibility,  speed,  current  drift,  loss  of  steering  control,  human 

error,  fish  attack. 

Result:  Damage  to  vessel  (flooding),  injury  from  impact,  sinking,  inability  to 

surface. 

SUBMERSIBLE  IS  ISOLATED  FROM  SURFACE  SUPPORT  VESSEL 

Scenario  1 : 

Event:  Submersible  loses  contact  with  surface  vessel  at  night,  in  fog  or  rain,  or 

other  weather  conditions. 

Cause:  Loss  of  communication,  drifting  in  current,  loss  of  visibility. 

Result:  Mass  passenger  anxiety  and/or  seasickness,  possible  collision  with  other 

ships. 

Scenario  2. 

Event:  Submersible  loses  contact  with  surface  support  vessel. 

Cause:  Radio  or  underwater  telephone  malfunction  -  redundant  system  also 

fails. 

Result:  Possible  collision/inability  to  rendezvous  with  surface  support. 

AIR  CONTAMINATION 

Scenario  1 : 

Event:  Battery  gas,  hydraulic  fluid  leakage  or  other  toxic  gas  release  occurs 

(see  also  Fire). 

Cause:  Lack  of  ventilation,  malfunction  of  ventilation  system,  etc. 

Result:  Injury  and  possible  death  to  passengers  and  crew. 

Scenario  2: 

Event:  Insufficient  supply  of  oxygen  or  buildup  of  CO2 

Cause:  Malfunction  of  oxygen  supply  or  CO2  scrubber  system. 

Result:  Injury  and  possible  death  to  passengers  and  crew. 
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Scenario  3: 


Event:  Oxygen  buildup  in  hull. 

Cause:  Malfunction  of  oxygen  supply  system  (leakage). 

Result:  Significant  fire  hazard  and  possible  O2  poisoning  of  passengers  and 

crew. 

PASSENGER  INJURY  /ILLNESS 

Scenario  1 ; 

Event:  An  unexpected  wave  washes  over  the  deck  of  the  submersible  and 

passenger  or  crew  is  swept  overboard. 

Cause:  Operating  in  high  sea  state  (above  3)  or  sudden  change  in  sea  state  due 

to  wind  or  unexpected  roll  due  to  passing  ship  wake. 

Result:  Possible  injury  or  drowning. 

Scenario  2: 

Event:  Passenger  slips  or  trips  during  transfer  between  submersible  and  taxi 

vessel. 

Cause:  Deck  is  slippery  or  uneven,  no  gangway  and/  no  railing  used,  crew  does 

not  assist. 

Result:  Possible  fall  or  drowning  especially  if  person  is  unable  to  swim.  Physical 

crushing,  if  fall  is  between  submersible  and  surface  ship. 

Scenario  3: 

Event:  Passenger  becomes  ill  while  inside  submersible. 

Cause:  Air  contamination,  sensitive  to  pressure  change,  claustrophobia. 

Result:  Injury  to  self  or  others  if  not  immediately  treated. 
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Technology  Society,  edited  by  John  Pritzlaff,  1974. 

4.  Correspondence  between  Coast  Guard  and  submersible  companies. 
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APPENDIX  B.  GENERIC  HAZARD  CHECKLIST  * 


1 .  BASIC  DESIGN  DEFICIENCIES 

a.  Examples: 

(1)  Sharp  corners 

(2)  Instability 

(3)  Excessive  weight 

(4)  Inadequate  clearance 

(5)  Lack  of  accessibility 

b.  Causes:  Improper  or  poor  design 

c.  Control  Methods:  Improve  or  change  design 

2.  INHERENT  HAZARDS 

a.  Examples: 

(1)  Mechanical  (i.e.,  rotating  equipment,  vibration) 

(2)  Electrical 

(3)  Explosives 

(4)  Flammable  gases  or  liquids 

(5)  Toxic  substances 

(6)  Acceleration  (flying  objects) 

(7)  Deceleration  (falling  objects) 

(8)  Temperature 

b.  Cause:  Integral  characteristic  which  cannot  be  designed  out 

c.  Control  Methods: 

(1)  Safety  Devices 

(a)  Isolation  (separation) 

(b)  Barriers  (guards) 

(c)  Interlocks  (deactivation) 

(d)  Pressure  release 

(e)  Temperature  sensor  (fuse) 

(2)  Warning  Devices  (Five  Senses) 

(a)  Visual  (eye)  -  color,  shape,  signs,  light 

(b)  Auditory  (hear)  -  bell 

(c)  Tactile  (touch) -shape,  texture 

(d)  Olfactory  (smell) 

(e)  Gustatory  (taste) 


*This  checklist  was  developed  by  TSC  using  material  adapted  from  Product  Safety 
Management  and  Engineering  by  Willie  Hammer,  1980. 
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(3)  Procedures  and  Training 


(a)  Use  of  safe  procedures 

(b)  Training 

(c)  Backout/recovery  procedures 

(d)  Protective  equipment 

(e)  Emergency  procedures 


3.  MALFUNCTIONS 

a.  Examples: 

(1)  Structural  failures 

(2)  Mechanical  malfunctions 

(3)  Power  failures 

(4)  Electrical  malfunctions 

b.  Causes: 

(1)  Faulty  design 

(2)  Manufacturing  defects 

(3)  Improper  or  lack  of  maintenance 

(4)  Exceeding  specified  limits 

(5)  Environmental  effects 

c.  Control  Methods:  Design 

(1)  Fail  safe  design 

(2)  Higher  safety  margins  (i.e.,  reduce  stress,  increase 
load  strength,  etc.) 

(3)  Redundant  circuitry  or  equipment 

(4)  Timed  replacement 

d.  Other  Control  Methods:  Safety  devices.  Warning  Devices, 
Procedures  and  Training  (See  Point  2.  c.  1-3) 


4.  MAINTENANCE  HAZARDS 

a.  Examples: 

(1)  Improper  connections 

(2)  Component  failures 

(3)  Equipment  damage 

(4)  Operational  delay 

b.  Causes: 

(1)  Lack  of  maintenance 

(2)  Improper  maintenance 

(3)  Hazardous  maintenance  conditions 
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c.  Control  Methods: 


(1)  Design 

(a)  Simplified  design 

(b)  Fail-safe  design 

(c)  Easy  access  to  equipment 

(d)  Elimination  of  need  for  special  tools  or  equipment 

(2)  Safety  devices 

(a)  Guards  for  moving  parts 

(b)  Interlocks 

(3)  Warning  devices 

(a)  Labels/Signs 

(b)  Bells 

(c)  Chimes 

(d)  Lights 

(4)  Procedures  or  Training 

(a)  Documentation  of  proper  procedures 

(b)  Improved  training  courses 

(c)  Housekeeping 


5.  ENVIRONMENTAL  HAZARDS 

a.  Examples 

(1)  Heat 

(2)  Cold 

(3)  Dryness 

(4)  Wetness 

(5)  Low  friction  (slipperiness) 

(6)  Glare 

(7)  Darkness 

(8)  Earthquake 

(9)  Gas  or  other  toxic  fumes 

b.  Causes 

(1)  Inherent 

(2)  Foreseen  or  unforeseen  natural  phenomena/conditions  which  do 
or  could  occur 

c.  Control  Methods  (see  also  4.c) 

(1)  Design 

(a)  Increased  resistance  to  temperature  changes 

(b)  Increased  resistance  to  dryness  or  wetness 

(c)  Fail-safe  design 
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(2)  Safety  Devices 


(a)  Sufficient  heating  or  cooling  capability 

(b)  Adequate  insulation 

(c)  Restricted  access 

(d)  Temperature  sensor 

(3)  Warning  devices 

(a)  Visual 

(b)  Auditory 

(c)  Smell 

(4)  Procedures  and  Training 

(a)  Use  of  safe  procedures 

(b)  Protective  equipment 

(c)  Training 

6.  HUMAN  FACTORS 

a.  Examples:  (Also  see  all  other  items) 

(1 )  Stress  (sensory,  mental,  motor) 

(2)  Physical  surroundings  (environment) 

(a)  Noise 

(b)  Illumination 

(c)  Temperature 

(d)  Energy  sources 

(e)  Air  and  humidity 

(f)  Vibration 

(3)  Errors 

(a)  Omission 

(b)  Commission 

(4)  Nonrecognition  of  hazards 

(5)  Incorrect  decisions 

(6)  Tasks  done  at  wrong  time 

(7)  Tasks  not  performed  or  incorrectly  performed 

b.  Causes: 

(1)  Inadequate  attention  to  human  design  criteria 

(2)  Poor  location,  layout  of  controls 

(3)  Equipment  complexity 

(4)  Inherent  hazards 

(5)  Incorrect  installation 

(6)  Failure  of  warning  devices 

(7)  Inadequacy  of  procedural  safeguards 

(a)  Failure  to  follow  instructions 

(b)  Lack  of  knowledge  of  procedures 

(8)  Inadequate  training 

(9)  Lack  of  or  improper  maintenance 


B-4 


c.  Control  Methods: 


(1)  Design  (to  address  items  (1)  -  (6) 

(2)  Safety  Devices  (Redundancy) 

(a)  Isolation  (separation) 

(b)  Barriers  (guards) 

(c)  Interlocks  (deactivation) 

(d)  Temperature  sensor  (fuse) 

(3)  Warning  Devices  (Five  Senses)  (Redundancy) 

(a)  Visual  (eye)  -  color,  shape,  signs,  light 

(b)  Auditory  (hear)  -  bell 

(c)  Tactile  (touch)  -  shape,  texture 

(d)  Olfactory  (smell) 

(e)  Gustatory  (taste) 

(4)  Procedures  and  Training 

(a)  Clear  warning  labels  (nature  of  hazard,  action  to  avoid 
injury,  consequences) 

(b)  Use  of  complete,  proper,  safe  procedures 

(c)  Adequate  training  (also  refresher  training) 

(d)  Backout/recovery  procedures 

(e)  Protective  equipment 

(f)  Emergency  procedures 

(g)  Proper  maintenance  procedures 
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APPENDIX  C.  PRELIMINARY  HAZARD  ANALYSIS 


The  Preliminary  Hazard  Analysis  (PHA)  presented  in  this  appendix  identifies 
potential  hazards  associated  with  the  operation  of  passenger  carrying  submersibles. 
This  PHA  is  based  on  the  passenger  carrying  submersible  system  hazards  described  in 
the  previously  prepared  system  definition.  The  PHA  format  allows  for  the  concise, 
systematic  documentation  of  a  great  number  of  potential  identified  hazards.  In  fact, 
the  PHA  approach  encouraged  a  broad,  brainstorming  thought  process  to  consider 
as  many  hazards  as  possible. 

The  contents  of  the  PHA  worksheets  are  organized  as  follows.  The  control  number 
for  each  line  item  is  contained  in  the  first  column.  This  number  identifies  the  line 
item  and  is  derived  from  the  combination  of  numbers  which  are  assigned  to  each  of 
the  systems,  subsystems,  and  hazard  descriptions.  Where  there  is  more  than  one 
casual  factor  for  a  specific  hazard  description,  each  of  the  causal  factors  is  assigned  a 
letter.  For  example,  the  control  number  1 . 1 .0 1 A  results  from  combining  the 
following  numbers:  1  the  Hull  system,  .1  for  the  Pressure  hull  subsystem,  and  .01  for 
the  hazard  description,  Implosion/Collapse.  The  A  indicates  that  the  first  cause  (of 
five,  in  this  case)  of  the  hazard  is  Improper  Design.  The  second  column  of  the  PHA 
worksheet  contains  a  brief  description  of  each  hazard  while  the  potential  causes  are 
noted  in  the  third  column.  The  fourth  column  describes  the  effect  of  the  specific 
hazard.  The  fifth  column  contains  the  risk  assessment  category  (RAC)  and  the  hazard 
risk  index  (HRI)  values  assigned  to  each  hazard  description.  (Refer  to  Figure  2-4). 
The  RAC  represents  the  hazard  risk  in  terms  of  both  the  severity  and  probability 
(e.g.,  iD  indicates  the  hazard  is  "Catastro,.  u  and  "Remote").  The  RACs  are 
grouped  into  four  numerical  HRI  categories.  The  HRI  value  (e.g.,  1  =  Unacceptable) 
is  used  to  determine  what  management  action  is  necessary.  The  RAC  and  HRI  values 
are  subjective  and  open  to  other  opinion  since  adequate  data  is  unavailable  to 
actually  determine  the  probability  of  the  hazards. 

The  recommendations  presented  in  column  six  of  the  PHA  worksheets  describe  the 
method  selected  to  eliminate  the  causes  or  minimize  the  effects  of  each  hazard  In 
order  of  preference,  the  types  of  recommendations  included  are: 

1 .  Design  to  eliminate  or  control  hazards, 

2.  Provide  safety  devices, 

3.  Provide  warning  devices,  and 

4.  Implement  special  procedures  and  training. 
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One  or  more  recommendations  are  provided  for  each  hazard  cause  identified  Many 
recommendations  are  based  on  existing  codes,  standards,  and  guidelines.  However, 
a  number  of  recommendations  are  either  based  on  information  which  may  need 
updating  or  are  not  currently  addressed  at  all  by  existing  references.  At  times, 
reference  sources  recommend  different  criteria  (i.e.,  percent  of  CO2  permitted);  in 
such  cases,  all  criteria  are  presented.  In  cases  where  no  reference  was  located,  the 
term  TBC  (To  be  Determined)  was  used. 

The  effect  of  the  recommendation  in  terms  of  reducing  the  RAC  and  HRI  is  presented 
in  column  sever.  (Note:  This  second  RAC  and  HRI  reflects  a  reduction  in  probability 
but  not  severity.) 

The  applicable  sections  of  codes,  standards  and/or  guidelines  which  were  used  as 
reference  sources  for  the  recommendations  are  identified  in  column  eight.  The 
references  used  are: 


33  CFR 


46CFR 


ABS 


ASME/ 

ANSI 

PVHO-la 


Code  of  Federal  Regulations,  Navigation  and  Navigable  Waters, 
Volume  33,  Parts  1  to  199,  as  applicable.  Revised  as  of  July  1 , 
1987. 

Code  of  Federal  Regulations,  Shipping,  Volume  46,  Parts  1-199 
Revised  as  of  October  1,  1987. 

American  Bureau  of  Shipping,  Underwater  Systems  and  Vehicles 
Rules  for  Building  and  Classing,  1979~~ 

American  Society  of  Mechanical  Engineers  and  American 
National  Standards  Institute,  Safety  Standard  for  Pressure 
Vessels  for  Human  Occupancy,  July  1987. 


NAVMAT  Naval  Material  Command,  Naval  Sea  Systems  Command,  Naval 
P-9290  Facilities  Engineering  Command,  Systems  Certification 
Procedures  and  Criteria  Manual  for  Deep  Submergence  Systems. 
U.S.  Navy,  June  1976. 


OPNAVINST  Certification  of  Operators  of  Manned  Non-Combatant 
P-9290.3  Submersibles.  U.S.  Navy.  December  12,  1968. 


MTSI  Marine  Technology  Society,  Safety  and  Operational  Guidelines 

for  Undersea  Vehicles,  Book  1,  Edited  by  John  A.  Prtzlaff,  1968. 

MTSII  Marine  Technology  Society,  Safety  and  Operational  Guidelines 

for  Undersea  Vehicles,  Book  II,  Edited  by  John  A.  Pritzlaff,  1974. 


MTSI  1 1 


Marine  Technology  Society  and  Society  for  Underwater 
Technology,  International  Safety  Standard  Guidelines  for 
Operation  of  Undersea  Vehicles.  Edited  by  John  Pritzlaff  1979. 


DSPA 


USCG 
May  1987 

USCG 

Stability 

Guidelines 


Deep  Sea  Pilots  Association,  Selection.  Training  and 
Qualification  of  Deep  Submersible  Pilots.  1971 . 

U.S.  Coast  Guard,  Passenger  Carrying  Submersibles,  May  19, 
1987. 

U.S.  Coast  Guard,  Guidelines  for  Stability  of  Submersibles. 
July  1,1988. 


The  ninth  column,  "Notes,"  was  used  to  indicate  whether  hazards  were  considered 
time  dependent. 


SPECIAL  NOTE:  The  Manning,  Certification,  and  Licensing  Requirements  formerly 
contained  in  46  CFR  Subchapter  B  (Subparts  10  and  12)  and  Subchapter  P  (Subpart 
157)  were  consolidated  into  Subchapter  B  as  of  January  8,  1989. 
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ELEMENT :  SUBMERSIBLE  PRELIMINARY  HAZARD  ANALYSIS 

SYSTEM:  HULL  PROJECT:  PASSENGER  CARRYING  SUBMERSIBLE  SYSTEM 

SUBSYSTEM:  PRESSURE  HULL 
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ABS,  SECTION  C.17. 


o 

cm 

< 


o  < 

Q 


u.  I  W 
U-  O  CJ 
LU  U  < 


<  to 

Q  <J 
CL  Z 

<  « 
fsi  >- 

<  CL 
X  CL 

< 

>-  O 
CL 

<  CL 


UJ  CO 
OL  < 
Q.  Q- 


^  a: 

co  co 
—  CO 


o 

or 

CL 


a: 

5 


UJ  UJ 

►—  U_ 

O  u- 


O 

►— 

cj 

< 


z  < 

UJ  CO 

5  3 

Q.  CJ 


Q  Q 

z 

UJ  UJ 

X  a. 


uj  *•  in  c 

a:  —  a: 

ZD  —  -  QZ 

cm  — •  m  u.  * 
*—  ■  CJ  <J 

CO  CO  «-  C_) 

Z  t—  •  VO  CO 

~  X  CJ  Vt  3 


< 

•  cm 

O  UJ 

•  CL 
CL  O 


< 

o 

uj  o 


CJ  cj 

—  C_) 

Q  CO 

z  r> 

—  •  CJ  • 
•3  —  H- 

i  Z  uj  cc  < 

►—  CL  —  h-  CL 

Q.  <  >  (O  UJ 

UJ  —i  UJ  UJ  CL 

o  <  cm  cm  O 


z  — •  -J  (NJ 
uj  u_  < 

<J  •—  CO 


CO  «- 

W  o' 


UJ  UJ  UJ 


oj  m 
(NJ  co 


—  uj  cm 
co  or  ZD 
O  3  co 

J  -J  CO 

o.  — 


CL 

UJ 

Q 


o  • 

'O  o 

'O  N-  r- 
sf  *- 


z  O 
-  O  — 
in  — 

N*  h-  U 
.  CJ  UJ 

co  uj  co 

CO 

z 

O  -  -« 


'O  *—  CJ  CO  to 

r*-  <  uj 

«-  a:  co  x  a: 


-  3 

O  -J 


CJ  CJ  ~ 


3  S 

_J  — 
—I  OJ 
O  uj 


O 
u. 

6  to 


Q 

Z 

< 


o 

cm 

CL 


CL  CO 
CO  CO  CO 
Z  UJ  CO 
«  >  < 


o 

< 


CL  ~  Z3 


>* 

>o 

o 


-  uj  a 
CO  oc  z> 

O  D  CO 
J  J  (O 

a.  —■  lli 


CL 

UJ 

o 


—  vf 


(O 

CO 

•  < 
*•  ND 

<  .  .. 
*—  (NJ  UJ 
■  •  CJ 

O  «“  Z 

X  < 

>  Z  Z 
CL  O  UJ 


<  CJ 
CL  UJ 
H*  CO 


'O 

s* 


CJ  —  CJ  CO 
UJ  <  UJ  H 


u.  O  O 

U  Ul  U.  « 

X  ►— 

geo  Z  CJ  CO  CO 

c  cj  uj  z  O 

_J  ~  ~  cl 

-J  CD  CO  o  c  QZ 

O  z  UJ  CL  O  o 

U.  <  O  Q.  <  U 


•  UJ  (J 
z  >  z 

o  —  < 


cm 

CJ 

o 

CL 

CL 


cm  CJ  _j 

“  3  3 

Z  CL 
O  z  UJ 
—  CL 

CO  Z3 

O  CO  CO 

CL  UJ  CO 
O'  J  UJ 

O  O  cm 
CJ  z  CL 


CL 

rD 

co 


< 

UJ 

X 

< 

cm 

z 

<  CL 

UJ 

X 

a 

1 

— • 

u_ 

CL 

u.  a. 

_ j 

►— 

z 

z 

1 

z 

UJ 

UJ 

1 

UJ 

►— 

»— 

Q 

UJ 

< 

Z 

CO 

CO 

o 

CL 

eg 

UJ 

>• 

>- 

CL 

UJ 

o 

o 

o 

_J 

CO 

CO 

A— 

03 

* 

* 

• 

• 

UJ 

CO 

Z 

z 

*— 

C"* 

*■— 

35 

c 

• 

» 

<o 

CJ 

z 

o 

►— 

o 


CO  UJ 
CO 

z 

o 


C-5 


1.028  LEAKAGE  THROUGH  COLLISION  OR  FLOOOING  IIS  1  PROVIDE  PROPER  1 10  2  MTS  III,  SECTION  TIME  DEPENDENT 

PRESSURE  HULL  ACCIDENT  DAMAGES  EMERGENCY  B.4.6.2. 

PRESSURE  HULL  PROCEDURES.  USCG,  MAY  87,  P.6. 


ELEMENT:  SUBMERSIBLE  PRELIMINARY  HAZARD  ANALYSIS 

SYSTEM:  HULL  PROJECT:  PASSENGER  CARRYING  SUBMERSIBLE  SYSTEM 

SUBSYSTEM:  PRESSURE  HULL 
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2. 2. OIF  LOSS  OF  PILOTING  LOSS  OF  ELECTRICAL  COLLISION  IIC  2  PROVIDE  EMERGENCY  HE  3  EMER  POWER:  ABS 

EQUIPMENT  POWER  OR  CONTROL  POWER  TO  PILOTING  SECTION  7.27. 

TO  PILOTING  EQUIPMENT  AND  EMER  PROC:  MTS 

EQUIPMENT  (SEE  EMERGENCY  III,  SECTION 

ALSO  3.3)  PROCEDURES.  B.4.6.4. 
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2.2.030  AUTOMATIC  PHOT  IMPROPER  OPERATION  COLLISION  1 1C  2  PROVIDE  PROPER  I  ID  2  OP  PROC:  MTS  II 

FAILS  TO  OF  AUTOMATIC  PILOT  OPERATING  SECTION  8.2. 

ACCURATELY  GUIDE  (SEE  ALSO  6.1)  PROCEDURES.  46  CFR  185.20-30 

SUB  FOLLOW  CFR  AND 

MANUFACTURER  FOR  33  CFR  164.15. 
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PLAN  REVIEW.  USCG,  MAY  87,  P.4 
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2.3.02F  INABILITY  TO  MOVE  LOSS  OF  HYDRAULIC  INABILITY  TO  IIC  2  PROVIDE  SYSTEM  HE  3  TBD  TIME  DEPENDENT 

VERTICALLY  POWER  OR  CONTROL  SUBMERGE,  REDUNDANCY. 

TO  VERTICAL  STAY 

PROPULSION  SYSTEM  SUBMERGED,  OR 
(SEE  ALSO  3.2)  SURFACE 
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STARBOARD  INSTALLATION  OF  MANEUVERING  B.10.0., 

MANEUVERING  SYSTEMS.  INSPECTION:  46 

STEERING  SYSTEM  INSPECTION  DURING  CFR  176.05. 

MANUFACTURE.  176.10, 

ABS,  SECTION  C.17. 
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REDUNDANCY,  SUCH 
AS  SEPARATION  OF 
PORT  AND 

STARBOARD  SYSTEMS. 


ELEMENT:  SUBMERSIBLE  PRELIMINARY  HAZARD  ANALYSIS 

SYSTEM:  SHIP  CONTROL  PROJECT:  PASSENGER  CARRYING  SUBMERSIBLE  SYSTEM 

SUBSYSTEM:  PROPULSION  AND  MANEUVERING 
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OPERATION  OF 
BALLAST  SYSTEM, 
VALVE  CONTROL,  ETC. 


ELEMENT:  SUBMERSIBLE  PRELIMINARY  HAZARD  ANALYSIS 

SYSTEM:  SYSTEMS  PROJECT:  PASSENGER  CARRYING  SUBMERSIBLE  SYSTEM 

SUBSYSTEM:  AIR 
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BALLAST  SYSTEM, 
VALVE  CONTROL,  ETC. 
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SYSTEM:  SYSTEMS  PROJECT:  PASSENGER  CARRYING  SUBMERSIBLE  SYSTEM 
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ELEMENT:  SUBMERSIBLE  PRELIMINARY  HAZARD  ANALYSIS 

SYSTEM:  SYSTEMS  PROJECT:  PASSENGER  CARRYING  SUBMERSIBLE  SYSTEM 

SUBSYSTEM:  LIGHTING 
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WITH  SURFACE  SURFACE  COMMUNICATIONS. 

VESSELS  COMMUNICATION 

SYSTEM 
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3.6.08A  EXCESSIVE  AMOUNTS  NO  C02  REMOVAL  AIR  IIC  2  FOLLOW  CFR,  ABS,  HE  3  46  CFR  197.328.  TIME  DEPENDENT 

OF  C02  IN  CABIN  SYSTEM  INSTALLED  CONTAMINATION,  AND  NAVY  ABS,  SECTION 

AND  UNABLE  TO  DEATH  GUIDELINES  FOR  5.7. 

SURFACE  C02  REMOVAL  NAVMAT  P-9290, 

SYSTEMS  SECTION  B.4.4.B. 


ELEMENT :  SU8MERS1BLE  PRELIMINARY  HAZARD  ANALYSIS 

SYSTEM:  SYSTEMS  PROJECT:  PASSENGER  CARRYING  SUBMERSIBLE  SYSTEM 

SUBSYSTEM:  LIFE  SUPPORT 
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SYSTEM  (SEE  ALSO  DEATH  PROCEDURES  TO  III,  SECTION 

6.1)  INCLUDE  ADHERANCE  B.2. 

TO  MANUFACTURER'S  TRAINING:  M 


ELEHENT:  SUBMERSIBLE  PRELIMINARY  HAZARD  ANALYSIS 

SYSTEM:  SYSTEMS  PROJECT:  PASSENGER  CARRYING  SUBMERSIBLE  SYSTEM 

SUBSYSTEM:  LIFE  SUPPORT 
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3.6.08L  EXCESSIVE  AMOUONT  INSUFFICIENT  AIR  I IC  1  PROVIDE  A  BACK-UP  HE  3  MTS  I ,  SECTION  C.3 

OF  C02  IN  CABIN  SUPPLY  OF  C02  CONTAMINATION,  SUPPLY  OF  C02 

ABSORBANT  DEATH  ABSORBANT  AS  PART 

OF  EMERGENCY 
SUPPLIES. 
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ELEMENT:  SUBMERSIBLE  PRELIMINARY  HAZARD  ANALYSIS 

SYSTEM:  SYSTEMS  PROJECT:  PASSENGER  CARRYING  SUBMERSIBLE  SYSTEM 

SUBSYSTEM:  EMERGENCY 
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